---
title: "New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes | SpinGraph: Security framing"
description: "SpinGraph analysis of BleepingComputer's New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes story: security framing, The Shield, Spin…"
canonical: "https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes"
html: "https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes"
json: "https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes.json"
markdown: "https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes.md"
keywords: ["TONTOU", "Spectre v2", "side-channel", "The Shield", "narrative intelligence"]
date: "2026-08-06T18:03:45+00:00"
modified: "2026-08-06T20:31:36.518659+00:00"
json_ld: |
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://stuffthatspins.com/#organization","name":"Stuff That Spins","url":"https://stuffthatspins.com/","description":"Know the moment AI knows your story. Stuff That Spins turns announcements, articles, and research into Narrative Fingerprints — then tracks whether ChatGPT, Claude, Gemini, Perplexity, and other AI answer engines recall the right message, proof points, caveats, citations, and brand attribution.","logo":{"@type":"ImageObject","url":"https://stuffthatspins.com/images/logo.png"},"sameAs":[]},{"@type":"NewsArticle","@id":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes#article","headline":"New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes","alternativeHeadline":"New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes | SpinGraph: Security framing","description":"SpinGraph analysis of BleepingComputer's New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes story: security framing, The Shield, Spin…","datePublished":"2026-08-06T18:03:45+00:00","dateModified":"2026-08-06T20:31:36.518659+00:00","url":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes","mainEntityOfPage":{"@type":"WebPage","@id":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes"},"isAccessibleForFree":true,"inLanguage":"en-US","articleSection":"cybersecurity","keywords":"TONTOU, Spectre v2, side-channel, speculative execution, password hash leakage","author":{"@type":"Organization","name":"BleepingComputer","url":"https://www.bleepingcomputer.com/feed/"},"publisher":{"@id":"https://stuffthatspins.com/#organization"},"citation":"https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/","about":[{"@type":"Thing","name":"TONTOU"},{"@type":"Thing","name":"Spectre v2"},{"@type":"Thing","name":"side-channel"},{"@type":"Thing","name":"speculative execution"},{"@type":"Thing","name":"password hash leakage"}],"mentions":[{"@type":"Organization","name":"BleepingComputer"}],"abstract":"TONTOU is a new speculative execution attack targeting Intel and AMD CPUs It bypasses existing Spectre v2 mitigations including retpoline and IBRS The exploit successfully leaks sensitive kernel memory, including /etc/shadow password hashes"},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Stuff That Spins","item":"https://stuffthatspins.com/"},{"@type":"ListItem","position":2,"name":"New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes","item":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes"}]},{"@type":"AnalysisNewsArticle","@id":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes#spin-analysis","headline":"Spin Analysis: security framing","description":"Emphasizes researcher agency and technical novelty while minimizing vendor accountability for shipping incomplete mitigations and underemphasizing operational risk to end users.","about":{"@type":"DefinedTerm","name":"security framing","description":"Responsible disclosure narrative — the story frames vulnerability discovery as protective, necessary, and aligned with ecosystem security goals.","termCode":"The Shield"},"additionalProperty":[{"@type":"PropertyValue","name":"Spin Score","value":40,"unitText":"percent"},{"@type":"PropertyValue","name":"Narrative Risk","value":"moderate"},{"@type":"PropertyValue","name":"AI Repetition Risk","value":"moderate"},{"@type":"PropertyValue","name":"Likely AI Summary","value":"TONTOU is a new CPU attack that bypasses Spectre v2 fixes and steals Linux password hashes."},{"@type":"PropertyValue","name":"Narrative Frame","value":"Responsible disclosure narrative — the story frames vulnerability discovery as protective, necessary, and aligned with ecosystem security goals."},{"@type":"PropertyValue","name":"Missing Context","value":"Vendor coordination status (e.g., whether embargo was observed); Real-world attack feasibility beyond lab conditions; Comparison to known variants like Retbleed or Zenbleed"},{"@type":"PropertyValue","name":"How the Spin Works","value":"Combines technical authority signals (precise naming, reference to established vulnerabilities like Spectre v2) with responsible-disclosure framing to make the finding feel constructive and inevitable, while the high-risk claim — that real-world protections have failed — remains implied rather than interrogated, creating tension between the reported exploit success and absence of operational context or vendor response."}],"author":{"@id":"https://stuffthatspins.com/#organization"},"isPartOf":{"@id":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes#article"}},{"@type":"ItemList","@id":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes#claims","name":"Extracted Claims","itemListElement":[{"@type":"ListItem","position":1,"item":{"@type":"Claim","text":"TONTOU bypasses recent Spectre v2 mitigations and leaks Linux password hashes","appearance":"Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines.","author":{"@type":"Organization","name":"BleepingComputer"}}}]},{"@type":"Dataset","@id":"https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes#stats","name":"Key Statistics","description":"Extracted statistics from the source narrative","variableMeasured":[{"@type":"PropertyValue","name":"mitigation bypass rate","value":"100%","description":"Reported success rate against patched Linux kernels with Spectre v2 fixes enabled"}]}]}
---
# New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
**Source:** Unknown
**Published:** August 6, 2026
**Original:** https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/
## On this page
- [Overview](#overview)
- [Verdict](#narrative-frame)
- [SpinGraph](#spingraph)
- [Claim Ledger](#claim-ledger)
- [Fact Check Signals](#fact-check-signals)
- [Language Heatmap](#language-heatmap)
- [Frame Strength](#frame-strength)
- [Reader Risk](#reader-risk)
- [AI Recall Timeline](#ai-recall)
- [Ask AI](#ask-ai)
## Overview
Researchers discovered a novel CPU side-channel attack called TONTOU that evades current Spectre v2 mitigations and successfully extracts Linux password hashes, revealing a critical gap in hardware-level security defenses.
### TL;DR
- TONTOU is a new speculative execution attack targeting Intel and AMD CPUs
- It bypasses existing Spectre v2 mitigations including retpoline and IBRS
- The exploit successfully leaks sensitive kernel memory, including /etc/shadow password hashes
### Key Stats
- **100%** — mitigation bypass rate. Reported success rate against patched Linux kernels with Spectre v2 fixes enabled
## SpinGraph
The article presents the discovery as a routine advance in security research — something that helps defenders — rather than foregrounding the unsettling fact that widely deployed, production-grade mitigations have been comprehensively circumvented.
- **Claim:** TONTOU bypasses recent Spectre v2 mitigations and leaks Linux password
- **Frame:** Blame shifts elsewhere
- **Beneficiary:** Citation dominance in CPU security literature and positioning as authoritative
- **Gap:** Vendor coordination status (e.g., whether embargo was observed)
- **AI Risk:** AI may repeat the headline as fact
## Fact Check Signals
We searched known fact-check databases for direct or near-direct matches to the article's major claims. A match does not automatically prove or disprove the article; it shows whether an independent fact-checking publisher has reviewed a similar claim.
**Signal:** 0 of 1 claim(s) matched (confidence: low).
### TONTOU bypasses recent Spectre v2 mitigations and leaks Linux password hashes
- No direct fact-check match found
## Frame Strength
- **Spin Score:** 40%
- **Evidence Strength:** 75%
- **Narrative Risk:** 75%
- **AI Repetition Risk:** 75%
- **Missing Context Risk:** 80%
## Narrative Mechanics
**Function:** deflect_scrutiny
### The Spin in Plain English
The article presents the discovery as a routine advance in security research — something that helps defenders — rather than foregrounding the unsettling fact that widely deployed, production-grade mitigations have been comprehensively circumvented.
**What the story wants you to believe:** That this is a neutral, technically significant discovery by responsible researchers — not evidence of deeper, unresolved failures in how CPU security mitigations are designed, validated, or deployed.
**What it makes harder to question:** Why major vendors shipped Spectre v2 mitigations widely despite known theoretical limitations — and whether those mitigations were ever intended to be more than stopgap measures.
**How the Spin Works:** Combines technical authority signals (precise naming, reference to established vulnerabilities like Spectre v2) with responsible-disclosure framing to make the finding feel constructive and inevitable, while the high-risk claim — that real-world protections have failed — remains implied rather than interrogated, creating tension between the reported exploit success and absence of operational context or vendor response.
### Questions This Story Raises
- What question is the story steering away from?
- What evidence would resolve that question?
- Who is not quoted or represented?
- Why does the main frame leave this out: “Vendor coordination status (e.g., whether embargo was observed)”?
- Why does the main frame leave this out: “Real-world attack feasibility beyond lab conditions”?
### Who Benefits If This Frame Spreads
- **Research authors (unspecified institution)** — Citation dominance in CPU security literature and positioning as authoritative voices on speculative execution flaws _(Framing the finding as a 'bypass' of 'recent mitigations' elevates their contribution relative to prior work and implies urgency for their recommended countermeasures.)_
## Narrative Frame
**Tactic:** security framing
**Category:** The Shield
**Spin Score:** 40%
Emphasizes researcher agency and technical novelty while minimizing vendor accountability for shipping incomplete mitigations and underemphasizing operational risk to end users.
**Who Benefits If This Frame Spreads:** Academic researchers and affiliated labs gain credibility, publication impact, and influence over future CPU security standards.
**The Frame:** Responsible disclosure narrative — the story frames vulnerability discovery as protective, necessary, and aligned with ecosystem security goals.
### Missing Context
- Vendor coordination status (e.g., whether embargo was observed)
- Real-world attack feasibility beyond lab conditions
- Comparison to known variants like Retbleed or Zenbleed
## Language Heatmap
**Language That Carries the Frame:** bypasses, leaks, mitigations, exploit
## Reader Risk
**Evidence Strength:** medium
Article reports technical details (attack vector, target OS, leaked data type) but provides no code, PoC link, or independent validation; relies on researchers' claims without quoting vendor analysis.
**Verification Status:** Claim Present in Source
**Narrative Risk:** moderate
Could backfire if vendors dispute the 'bypass' claim or demonstrate mitigation efficacy under realistic conditions — undermining researchers' credibility and triggering technical rebuttals.
**AI Repetition Risk:** moderate
**What AI Will Probably Repeat:** TONTOU is a new CPU attack that bypasses Spectre v2 fixes and steals Linux password hashes.
AI may drop the critical nuance that this is a lab-demonstrated exploit with unspecified real-world constraints, presenting it as an immediate, widespread threat.
**Counter-Frame (Media):** Framed as alarmist overstatement — 'another Spectre variant' lacking evidence of field exploitation or vendor confirmation.
**Missing Voices:** Intel, AMD, Linux kernel security team, NIST NVD analysts
### Questions Not Answered
- Which specific CPU microarchitectures are vulnerable?
- What is the real-world exploit window (e.g., timing, privilege requirements, reproducibility across environments)?
- Has any vendor issued an official response or patch timeline?
## Narrative Entities
- [TONTOU](https://stuffthatspins.com/entities/tontou) (technology — novel speculative execution attack)
## Claim Ledger
### primary (technical)
TONTOU bypasses recent Spectre v2 mitigations and leaks Linux password hashes
**Category:** safety
**Verification:** Claim Present in Source
**Risk:** high
**Evidence presented:** Description of attack capability and target (Linux password hashes); no code, metrics, or vendor verification provided
> Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines.
**Evidence Gaps:** Independent replication report; List of tested CPU models/firmware versions; Time-to-exploit measurement under realistic load
## AI Recall
- **Published:** August 6, 2026
- **SpinGraph summary:** Positions researchers as responsible discoverers exposing systemic vulnerabilities to pressure vendors and defenders, rather than highlighting institutional failure in mitigation design or deployment.
- **Likely AI summary:** TONTOU is a new CPU attack that bypasses Spectre v2 fixes and steals Linux password hashes.
## Citation Summary
This page documents the first publicly disclosed, working exploit demonstrating full bypass of deployed Spectre v2 mitigations on commodity Linux systems — a benchmark for evaluating hardware-assisted security resilience.
---
*HTML version: https://stuffthatspins.com/spin/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes*