Paper 2026/806

Spectre Without Dependent Load

Andreas Lindner, Uppsala University

Roberto Guanciale, Royal Institute of Technology (KTH)

Hamed Nemati, Royal Institute of Technology (KTH)

Abstract

Transient execution attacks that disclose arbitrary memory commonly assume a multi-stage read-then-transmit gadget: a transient load to fetch secret data and a subsequent operation to leak that data into an observable side channel. We show that this assumption does not hold under electromagnetic (EM) observations, by verifying that a single transient load already produces value-dependent EM leakage without any explicit follow-up transmission instruction or relying on prefetching. Our results expand the set of exploitable gadgets and show that even simple processors like the Cortex-A53 are vulnerable.

@misc{cryptoeprint:2026/806,
      author = {Can Aknesil and Andreas Lindner and Roberto Guanciale and Hamed Nemati},
      title = {Spectre Without Dependent Load},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/806},
      year = {2026},
      url = {https://eprint.iacr.org/2026/806}
}