AIBRIEF
A 4 byte floating point load leaks stale L1 cache data into the CPU's working registers at hundreds of MB/s, and there is no software patch.
LoongLeak is a hardware-level data leak in Loongson 3A5000 and 3A6000 CPUs, the Chinese-designed processors that now appear in domestic PCs, servers, and government desktops. Disclosed this week at USENIX Security '26 in Baltimore by a CISPA Helmholtz team, the bug sits in a 4-byte floating-point load (FLD.S). The instruction returns the destination register's high 32 bits as architecturally "uncertain." On real hardware, those bits contain stale data from the L1 data cache, and an attacker can prime the cache to target a specific set, per the authors' project page.
That makes this an architectural leak, not a Spectre-style transient-execution side channel. There is no timing signal and no statistical amplification: the data lands directly in vector registers at more than 300 MB/s, with 28 bytes leaked per load. From unprivileged userspace, the team pulled AES keys used by Linux disk encryption, partial root password hashes from a sibling thread on 3A6000 SMT, ffmpeg stack canaries, and ASLR-breaking data, across container and VM boundaries, according to the LoongLeak paper.
A software patch is not possible; the bug is in silicon. The team recommends evicting the L1 data cache on kernel-to-user transitions (max 1.4% benchmark cost, typically under 0.1%). On 3A6000, the team also recommends disabling SMT, which halves the logical core count. Loongson has reproduced the issue and shipped a new silicon revision of the 3A6000, the only path to a fix without the mitigation cost. The vendor has not issued a public advisory or CVE, and no tools exist to detect an active LoongLeak attack.