Reported by 3 outlets

Timeline

1. original reporting

   DRAM Scrambling Attack Unlocks Protected Memory on AMD CPUs

   cyberpress.org · 60d ago · August 14th, 2026

   Security researcher Christopher Domas has disclosed a memory-controller attack that can expose highly protected DRAM regions on certain older AMD processors. The research, released with the open-source skitter-creek-bath-salts project, targets AMD Family 15h and 16h systems, in which configuration registers that control memory address translation may not be lockable. The technique is not a conventional software permission bypass and is distinct from Rowhammer . Rather than inducing bit flips in DRAM, it changes the final mapping between a physical address and the bank, rank, row, and column coordinates selected in memory. This creates a temporary alternative view of DRAM in which an address accessible to privileged software can resolve to the same memory cell as a protected region. New DRAM Scrambling Attack The attack matters because platform security controls generally operate above the memory controller. Page tables, IOMMUs, firmware carveouts, chipset locks, and processor protections determine whether a physical address is allowed. Domas’s work operates underneath those controls, modifying the translation applied after the platform has accepted the physical address. Security checks can therefore see an apparently legitimate request while the controller directs it to an unintended location in DRAM. The project calls this process “spaghettifying” memory. By changing the controller’s DRAM swizzle and address-translation behavior, the researcher creates aliases between ordina

2. update from gbhackers.com

   DRAM Scrambling Attack Unlocks AMD CPU PSP, SMM and Microcode

   gbhackers.com · 60d ago · August 14th, 2026

   Security researcher Christopher Domas has released a proof-of-concept project called “skitter-creek-bath-salts,” which demonstrates a vulnerability in AMD’s DRAM-controller configuration that could compromise hardware-enforced memory isolation. This technique, tested on AMD Family 16h processors, manipulates address-translation behavior in the memory-controller layer, allowing access to data typically protected from the operating system, the kernel, and even ring-0 […] The post New DRAM Scrambling Attack Unlocks AMD CPU PSP, SMM and Microcode appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from github.com

   Unlocking everything on the AMD CPU with DRAM scrambling: PSP, C6, microcode, SMM, etc https:// github.com/xoreaxeaxeax/s kitter-creek-bath-

   github.com · 32d ago · September 11th, 2026

   Unlocking everything on the AMD CPU with DRAM scrambling: PSP, C6, microcode, SMM, etc https:// github.com/xoreaxeaxeax/s kitter-creek-bath-

   via X https://github.com/xoreaxeaxeax/skitter-creek-bath-salts