New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses
BTR, a new Spectre-v2 variant from VUSec researchers, hijacks stale JIT branch predictions to leak kernel secrets from fully patched systems.
72
CVE-2026-64507
- CVSS
- —
- EPSS
- <1%p14
- Published
- ·
- Modified
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
In the news
4 storiesResearchers Use New CPU Attack to Steal Linux Root Password Hash From Memory
Researchers' Branch Target Reuse attack leaks Linux root password hashes via stale CPU predictions.
68
Spectre bug is back, this time to haunt JIT engines
Researchers disclose Branch Target Reuse, a Spectre v2 JIT attack that can leak Linux root password hashes.
64
New Spectre v2 attack variant leaks Linux root password hash in minutes
VUsec's Branch Target Reuse Spectre v2 variant leaks Linux root password hashes in minutes by abusing stale branch predictor entries after JIT code reuse.
63