BreachPublished 6 Aug 2026

New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

Source Bleeping Computer

linux

Description

Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. [...]

Impact

The impact of the TONTOU attack is the unauthorized disclosure of sensitive information, namely Linux password hashes, which could potentially be used to escalate privileges or compromise user accounts. This undermines the effectiveness of existing Spectre v2 mitigations and poses a risk to the confidentiality of data on affected Linux systems. There is no evidence of active exploitation in the wild, but the vulnerability represents a significant theoretical risk.

Defensive guidance

Since this attack bypasses existing Spectre v2 mitigations, affected organizations should monitor vendor communications for updates or patches addressing this new technique. Until official fixes are available, consider applying any recommended microcode or kernel updates and follow best practices for limiting speculative execution side-channel risks as advised by CPU and OS vendors.

References

bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:11 UTC

References

Community reviews

Related threats