Cross-context data disclosure via branch history injection

Information disclosure in Arm Cortex and Neoverse processors allows local users to read data across security contexts. Shared Branch History Buffer state lets attacker-controlled branch history steer a victim branch onto an exfiltration gadget, and speculative cache allocations expose data through timing. Local low-privileged code and a usable victim gadget are required; demonstrations extract Linux kernel memory without altering data or availability.