This is reminiscent of the #TF CVE from last year: https://bugzilla.redhat.com/show_bug.cgi?id=1464473 https://bugzilla.redhat.com/show_bug.cgi?id=1464473 ...

This is reminiscent of the #TF CVE from last year: https://bugzilla.redhat.com/show_bug.cgi?id=1464473 https://bugzilla.redhat.com/show_bug.cgi?id=1464473 ... Except not requiring a buggy instruction emulator. Traps and MOVSS shadowing (and any other temporary state after an instruction pointer increment) are very complex/bug prone, and I kinda wish x86 weren't so willing to keep adding these in (recent additions that come to mind being MTF and PEBS).