# Spectre-v2 Branch Target Reuse (BTR) Attack Leaks Linux Kernel Memory Despite Existing Defenses (CVE-2026-64507, CVE-2026-64508)

> Researchers from VUSec (VU Amsterdam) and Scuola Superiore Sant'Anna disclosed Branch Target Reuse (BTR), a Spectre-v2 variant in which stale indirect branch prediction entries survive JIT code-cache reuse, giving a transient execute-after-free primitive. Two end-to-end exploits via the Linux kernel's unprivileged classic BPF (cBPF) JIT recover the root password hash in about 3-5 minutes on fully patched Intel systems; Linux fixes are merged.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2796
- **ID:** TL-2026-2796
- **Severity:** HIGH (CVSS 5.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-64507, CVE-2026-64508

## Description

Branch Target Reuse (BTR) is a Spectre-v2 variant described in the paper 'Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries' (Sander Wiebing, Yuhui Zhu, Alessandro Biondi, Cristiano Giuffrida; VUSec and Scuola Superiore Sant'Anna; accepted to ACM CCS 2026; embargo lifted 2026-09-29). The root cause is that modern CPUs restore architectural code coherence after self-modifying code but do not necessarily invalidate stale indirect branch prediction entries. In JIT engines, those stale targets outlive the original code and are reused when the code cache is repopulated, yielding a transient 'execute-after-free' primitive that hijacks speculative control flow into newly generated code at obsolete offsets.

The attack proceeds in four steps: (1) train a victim indirect branch to jump into attacker-controlled JIT code, (2) get that JIT chunk deallocated, (3) arrange for new code to be emitted over the same addresses, and (4) trigger the branch again so the CPU speculatively follows the stale BTB entry into misaligned offsets of the reallocated JIT memory. Against the Linux kernel, the exploit uses unprivileged classic BPF programs (created as seccomp filters for the training and target chunks) to train the prediction, free the original program, and place a different program in the reused memory. Two end-to-end exploits leak kernel memory at roughly 8 bytes per second and recover the root password hash in about 3 minutes on Intel Raptor Cove and about 5 minutes on Lion Cove, with default protections enabled. An adaptation defeats BPF constant blinding by encoding attacker bytes in forward jump offsets (a technique from Maisuradze et al., 2016) instead of 4-byte immediates, creating misaligned gadgets that decode differently at alternate alignment boundaries; the hash is still recovered within 5 minutes.

The behaviour was confirmed on every CPU tested, spanning Intel, AMD and Arm, and against three JIT engines: the Linux kernel cBPF JIT, Mozilla Firefox's SpiderMonkey (WebAssembly literal pools via f64.const; estimated tens of bytes per second, full browser exploit not achieved), and Oracle GraalVM (jumping past masking operations that protect sandbox boundaries into unmasked memory access). The same group had previously published an 'Interrupt Injection' attack in August 2026.

Mitigations: the Linux kernel fixes are CVE-2026-64507 ('x86/bugs: Enable IBPB flush on BPF JIT allocation', issuing an IBPB flush on BPF JIT memory reuse when Spectre-v2 mitigations are in use, skipped if the BPF dispatcher already uses retpolines, and only when BPF JIT is enabled) and CVE-2026-64508 (BPF hardening against JIT spraying by flushing branch predictors before reusing JIT memory). Both were published 2026-07-25 (OSV record modified 2026-08-21) and fixed in stable releases 6.1.183, 6.6.145, 6.12.97, 6.18.39 and 7.1.4 (affected since 5.18.0), and in mainline 7.2-rc2. Debian shipped fixes via DSA-6405-1, DLA-4724-1 and DLA-4777-1 (Bullseye not affected). Oracle GraalVM randomizes JIT code-cache locations; Mozilla is relying on site isolation and considering IBPB-based mitigations. Third-party trackers list CVE-2026-64507 at CVSS 5.5 (Medium); the sources reviewed do not publish a CVSS vector and no in-the-wild exploitation is reported. A public proof of concept and demo video accompany the research.

## MITRE ATT&CK

- T1003.008 /etc/passwd and /etc/shadow
- T1212 Exploitation for Credential Access
- T1005 Data from Local System
- T1203 Exploitation for Client Execution

## Sources

- [New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses](https://thehackernews.com/2026/09/new-spectre-v2-btr-attack-leaks-linux.html)
- [New Spectre v2 attack variant leaks Linux root password hash in minutes](https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes/)
- [Branch Target Reuse Turns JIT Compilers Into a Spectre v2 Launchpad, Leaking Root Hashes in Minutes](https://hwbusters.com/news/branch-target-reuse-turns-jit-compilers-into-a-spectre-v2-launchpad-leaking-root-hashes-in-minutes/)
- [VUSec: Branch Target Reuse (BTR) project page](https://www.vusec.net/projects/btr/)
- [OSV: CVE-2026-64507](https://osv.dev/vulnerability/CVE-2026-64507)
- [OSV: CVE-2026-64508](https://osv.dev/vulnerability/CVE-2026-64508)
- [Debian Security Tracker: CVE-2026-64507](https://security-tracker.debian.org/tracker/CVE-2026-64507)
- [INCIBE-CERT early warning: CVE-2026-64507](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-64507)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2796