VUSec (Organization): news timeline & CVEs

Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries

VUSec disclosed Branch Target Reuse, a practical Spectre-v2 attack on JIT engines via stale branch-prediction entries.

VUSec announced Branch Target Reuse (BTR), a Spectre-v2 technique that uses stale branch-prediction entries to attack JIT engines. The disclosure points to a CCS 2026 paper, a project page, and a public GitHub repository. The oss-security note mentions mitigations but does not assign a CVE or report exploitation observed in the wild.

oss-security00:43 UTC · 5h agoResearch 4 sources

New Spectre v2 attack variant leaks Linux root password hash in minutes

VUsec's Branch Target Reuse Spectre v2 variant leaks Linux root password hashes in minutes by abusing stale branch predictor entries after JIT code reuse.

Researchers at VU Amsterdam's VUsec and Scuola Superiore Sant'Anna developed Branch Target Reuse (BTR), which exploits stale branch predictor targets when JIT engines reuse freed code memory. An end-to-end exploit against Linux cBPF recovered the root password hash from a running 'su' process at eight bytes per second, taking 3-5 minutes on Intel Raptor Cove and Lion Cove CPUs. The issues received CVE-2026-64507 and CVE-2026-64508, with fixes already merged into the Linux kernel. The behavior was confirmed on Intel, AMD, and Arm CPUs, and a variant bypassed constant blinding hardening while still recovering the hash within five minutes.

BleepingComputerupdated 00:43 UTC · 5h agofirst Sep 29, 17:10 UTC · 13h agoResearch 4 sources CVE-2026-64507 CVE-2026-64508

New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks

New Spectre-v2 variant BTR lets attackers leak arbitrary memory, including root password hashes, from Intel, AMD, and Arm systems via stale JIT branch predictions.

VUSec and Scuola Superiore Sant'Anna researchers disclosed Branch Target Reuse (BTR), a Spectre-v2 variant exploiting stale branch predictor entries left by self-modifying JIT code. End-to-end exploits against the Linux kernel's unprivileged cBPF JIT leak arbitrary memory at 8 bytes per second, recovering the root password hash on fully updated Intel systems with default mitigations enabled. Linux shipped an IBPB-based x86 mitigation, Oracle partially mitigated GraalVM via code-cache randomization, Mozilla is prioritizing site isolation, and AMD says existing Spectre-v2 guidance applies.

SecurityWeekupdated 00:43 UTC · 5h agofirst Sep 29, 17:00 UTC · 13h agoResearch 4 sources

New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses

BTR, a new Spectre-v2 variant from VUSec researchers, hijacks stale JIT branch predictions to leak kernel secrets from fully patched systems.

Researchers at VUSec and Scuola Superiore Sant'Anna disclosed Branch Target Reuse (BTR), a Spectre-v2 variant that abuses stale indirect branch prediction entries left after JIT self-modifying code, yielding a transient execute-after-free primitive. Two end-to-end Linux kernel exploits leak the root password hash within minutes from fully patched Intel systems with default protections, at 8 bytes per second. Affected targets include SpiderMonkey (Firefox), GraalVM, and the Linux cBPF JIT across Intel, AMD, and Arm CPUs; kernel mitigations were merged for CVE-2026-64507 and CVE-2026-64508.

The Hacker Newsupdated 00:43 UTC · 5h agofirst Sep 29, 17:00 UTC · 13h agoResearch 4 sources CVE-2026-64507 CVE-2026-64508

VUSec

Timeline4 articles

Related CVEsby mentions

Appears with

Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries

New Spectre v2 attack variant leaks Linux root password hash in minutes

New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks

New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses