Commercial RISC-V chips fall to Spectre-style attacks, security-conference paper finds

RISC-V, the open royalty-free instruction set that runs in everything from microcontrollers to AI accelerators, just cleared a milestone x86 and ARM cleared a decade ago. A paper at USENIX Security '26 demonstrates, for the first time, a Spectre-class attack leaking arbitrary Linux kernel memory from commercial high-performance RISC-V chips. The result is not a verdict against the architecture. It is the architecture arriving at the table where disclosure-and-patch cycles are the price of high-performance silicon.

The paper, "Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processors," is by Lukas Gerlach at CISPA, Marton Bognar at DistriNet (KU Leuven), Daniel Weber and Michael Schwarz at CISPA, and Jo Van Bulck at DistriNet. The team systematically assessed every commercially available out-of-order RISC-V processor: the SiFive P550 and the T-Head Xuantie C910 and C920. All three were vulnerable to a range of Spectre attacks. Their proof-of-concept, according to The Register, leaks arbitrary Linux kernel memory from the Xuantie C910 at 338 bytes per second.

Spectre is the class of side-channel attacks disclosed in 2018 that exploit speculative execution, a trick modern processors use to run faster by guessing what work comes next and rolling back the guess if they guessed wrong. The guess leaves traces in cache and other processor state that an attacker can read, even though the speculated instructions never logically run. The architectural fix is a fence or barrier that halts speculation until a dangerous condition is resolved. RISC-V has no dedicated speculation barrier in its base instruction set, so mitigations have to be inserted by compilers, operating systems, and individual programs.

Before this paper, RISC-V Spectre work had concentrated on open-source academic designs. Commercially available RISC-V silicon had been "widely perceived as too simple to be vulnerable." The Gerlach et al. result challenges that assumption directly. The Xuantie C910, C920, and SiFive P550 are real, shipping cores used in production boards. The same speculative-execution machinery that drove x86 and ARM into their Spectre disclosures is now reproducible on these parts.

The same team has been landing Linux kernel patches for RISC-V Spectre v1 protections since late last year. Phoronix reported in December 2025 on Gerlach's patch series adding pointer masking in uaccess routines, the analog of the arm64 uaccess_mask_ptr mechanism, plus array_index_nospec() sanitization of the syscall number before the kernel indexes into the syscall table. The patches are upstream. What the USENIX paper adds is the missing audit on the hardware side: an empirical answer to which instructions actually halt speculation on commercial RISC-V cores, plus a benchmark of how the software mitigations perform.

An arXiv preprint from August 10, 2026 introduces ANTMAN, the first secure-by-design RTL-level runtime detector for stealthy branch predictor attacks on the BOOM RISC-V core, evaluated under both NLP and TAGE branch predictors. A consortium of Belgian and Dutch researchers at USENIX Security '26 is publishing a dozen papers on the broad impact of these attacks, including work on a Speculative Store Bypass variant in a RISC-V core equipped with a memory-dependence predictor. The Gerlach et al. paper is the commercial-silicon counterpart: the moment the open ecosystem catches up to the same scrutiny closed ISAs weathered years ago.

Two caveats keep the picture honest. First, the 338 B/s figure is a proof-of-concept on the Xuantie C910 in controlled conditions; real-world exploitability depends on whether a target workload lets an attacker get the memory access the proof-of-concept needs. Second, the affected chips are specific: the P550 and the Xuantie C910 and C920. Other RISC-V cores, including embedded controllers, simpler in-order designs, or newer out-of-order parts with custom speculation barriers, are not necessarily in the same boat. The paper audits what is shipping, not the architecture as a whole.

The watch item for anyone running RISC-V silicon is the same as it was for x86 and ARM a decade ago. Which deployments actually expose the affected cores to an attacker who can already run code on the machine? How fast do the kernel patches you need reach the distribution you ship? The Phoronix patch series is upstream. The remaining question is when major RISC-V Linux distributions pick it up, and whether cloud and edge vendors expose the Xuantie and SiFive cores in tenant-shared configurations where Spectre-class issues have the most leverage.