TONTOU kernel memory leak via branch predictor re-poisoning
CVE / CVSS
| CVE | CVSS | EPSS | Vector | Source |
|---|---|---|---|---|
| CVE-2026-68480 (opens in a new tab) Debian (opens in a new tab) | not scored yet | 0.23 % | – | – |
Base scores are looked up from NVD or, if NVD has none yet, the CVE record. Proxmox itself does not publish CVSS scores. “Actively exploited” comes from the CISA KEV catalog, EPSS (probability of exploitation in the next 30 days) from FIRST.
Affected packages
proxmox-kernel-*
Details
A new technique to leak kernel memory despite spectre v2 mitigations being in place to neutralize the branch predictor state was discovered. This technique uses interrupt injection to re-poison the branch predictor during the window between neutralization and return of execution.
This technique is only applicable on AMD and Intel CPUs.
Fixed in
- proxmox-kernel-7.0.14-11-pve(-signed) (Trixie based products)
- proxmox-kernel-6.8.12-41-pve(-signed) (Bookworm based products)
References
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.