Gerlach

www.usenix.org • August 13, 2026

Lukas Gerlach, CISPA Helmholtz Center for Information Security; Marton Bognar, DistriNet, KU Leuven; Daniel Weber and Michael Schwarz, CISPA Helmholtz Center for Information Security; Jo Van Bulck, DistriNet, KU Leuven

Speculative execution attacks have been extensively studied on mainstream x86 and ARM architectures. However, on RISC-V, research has mostly concentrated on open-source academic designs. Commercially available RISC-V silicon is widely perceived as too simple to be vulnerable, and as a result, no end-to-end attacks have been demonstrated on real hardware to date and essential software such as the Linux kernel remains unmitigated.

In this paper, we challenge that assumption. We systematically assess all commercially available out-of-order RISC-V processors (SiFive P550 and T-Head Xuantie C910/C920), finding them vulnerable to a range of Spectre attacks, and demonstrate the first Spectre attack leaking arbitrary kernel memory on real RISC-V hardware. Concerningly, our analysis reveals that mitigations in compilers, operating systems, and applications remain largely absent, and that the RISC-V instruction set lacks a dedicated speculation barrier. As a stopgap solution, we empirically characterize which instructions can halt speculation on commercial processors. We additionally audit the Linux kernel for Spectre gadgets and contribute patches, several of which have been accepted upstream. Finally, we evaluate and benchmark software-based Spectre mitigations and derive recommendations for the evolving RISC-V ecosystem, laying the groundwork for securing real hardware as it enters security-critical deployments.

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RISC-V Processors Found Vulnerable to Spectre Attacks Researchers have revealed that certain commercially available RISC-V processors are vulnerable to Spectre attacks, challenging the assumption that this architecture is immune due to its simplicity. Specifically, the SiFive P550 and T-Head Xuantie C910/C920 processors can be exploited using various Spectre variants, including Spectre-PHT and Spectre-BTB. A proof-of-concept attack demonstrated the ability to leak arbitrary Linux kernel memory at a rate of 338 B/s. The study highlights a lack of mitigations in software and the absence of a dedicated speculation barrier in the RISC-V instruction set. Researchers have also contributed patches to the Linux kernel to address these vulnerabilities. The findings were presented at the 35th Usenix Security Symposium, emphasizing the need for security measures as RISC-V enters critical deployments. 4 sources 68

Extracted Entities

Gerlach

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (7)

Vulnerabilities (1)