Researchers Use New CPU Attack to Steal Linux Root Password Hash From Memory

Branch Target Reuse (BTR) is a newly disclosed variant of the Spectre-v2 attack that leverages stale CPU branch-prediction data to leak sensitive information from Linux memory, including root password hashes.

This attack specifically targets just-in-time (JIT) compilers found in the Linux kernel, web browsers, and various language runtimes.

BTR takes advantage of a vulnerability that arises when code memory is reused, leading to a mismatch with the processor’s branch target buffer.

When a JIT engine deletes previously generated code and later allocates different code to the same memory space, modern CPUs may still hold onto old indirect-branch predictions.

An attacker can exploit stale predictions to trigger speculative execution at an outdated location, leaving observable microarchitectural traces such as cache activity even after the CPU discards the incorrect path.

New CPU Attack Steals Linux Root Password Hashes

By measuring these effects, attackers can infer sensitive bytes from protected memory through side-channel methods. This technique is referred to as speculative execute-after-free, as it allows the CPU to follow a target associated with code that no longer exists.

In their evaluations of the BTR attack, researchers tested it against Linux’s classic Berkeley Packet Filter (cBPF), Mozilla Firefox’s SpiderMonkey JavaScript engine, and Oracle’s GraalVM.

They successfully developed two proof-of-concept exploits against the Linux kernel’s cBPF JIT compiler, including an exploit that functioned even with cBPF constant blinding in place.

In the Linux demonstration, an unprivileged local process first trained an indirect branch to a JIT-generated cBPF code block. The attacker then removed that code block and arranged for a different cBPF program to reuse part of the same JIT memory region.

When the indirect branch was triggered again, the CPU used the stale target prediction and speculatively executed attacker-controlled bytes at a misaligned offset.

The researchers demonstrated that they could leak arbitrary kernel memory at a rate of about 8 bytes per second on modern Intel processors.

Notably, they walked through the Linux kernel task list, identified a running su process, inspected its memory, and successfully extracted the root password hash after it had been loaded into memory.

VUSec testing showed that the hash could be recovered in an average of about three minutes on Raptor Cove systems and five minutes on Lion Cove systems.

This attack is particularly concerning because it managed to bypass enabled mitigations on the Linux configurations tested. However, it does necessitate that the attacker run local code and manipulate JIT-compiled cBPF programs, meaning it is not a direct remote network attack.

BTR is significant for JIT engines that frequently allocate, free, and reuse executable memory. While unprivileged eBPF usage is limited, classic BPF remains in use for seccomp filtering, socket filters, browser sandboxes, containers, and packet-processing tasks.

SpiderMonkey, although not exploited in full, was also identified as being susceptible due to the potential for stale predictions to persist across code-cache reuse.

To mitigate the risks posed by this attack, Linux kernel developers have issued fixes tracked as CVE-2026-64507 and CVE-2026-64508.

These updates include an Indirect Branch Prediction Barrier (IBPB) to clear stale indirect-branch predictions during BPF JIT memory reuse.

Organizations should update their kernel, GraalVM deployments, and browser versions to improve security. Additionally, minimizing untrusted local code execution, sandboxing workloads, and implementing timely kernel patches are crucial defensive measures.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC