Cybersecurity
Researchers disclose Spectre-v2 BTR attack on Linux
Researchers from VUSec and Scuola Superiore Sant'Anna said a new Spectre-v2 variant called Branch Target Reuse could affect JIT engines and the Linux kernel, and that proof-of-concept exploits recovered a root hash.
- Researchers from VUSec and Scuola Superiore Sant'Anna said they had disclosed Branch Target Reuse, a Spectre-v2 variant affecting JIT engines in browsers, runtimes and the Linux kernel across several CPU vendors.
- They said the attack depended on stale indirect branch prediction entries surviving code replacement in JIT engines and being reused after the cache was repopulated.
- The researchers said SpiderMonkey, GraalVM and the Linux kernel's cBPF JIT were affected, though they reported different exploitability and leakage rates.
- They said two proof-of-concept exploits against Linux could recover the root password hash in minutes on an Intel system that had been fully patched and left with default protections enabled.
- They said mitigations had been merged into the Linux kernel as CVE-2026-64507 and CVE-2026-64508.
Researchers from VUSec and Scuola Superiore Sant'Anna said they had disclosed Branch Target Reuse, which they described as a Spectre-v2 variant affecting JIT engines in browsers, runtimes and the Linux kernel on multiple CPU vendors.
In their paper, they said stale indirect branch prediction entries could remain after self-modifying code was replaced, so later JIT allocations could steer transient execution to old offsets. They said that could bypass hardening or reach misaligned gadgets.
The team said they evaluated SpiderMonkey, GraalVM and the Linux kernel's cBPF JIT, and found all three affected, though with different exploitability and leakage characteristics.
They said two proof-of-concept exploits against Linux could recover the root password hash within minutes on a fully patched Intel system with default protections enabled. Following responsible disclosure, they said fixes had been merged into the Linux kernel as CVE-2026-64507 and CVE-2026-64508.
The researchers said GraalVM reduced reuse by randomising JIT code-cache locations, while Mozilla had considered IBPB-based mitigations but was focusing on site isolation.
Named in this story
People
- Sander Wiebing
- one of the paper's researchers
- Yuhui Zhu
- one of the paper's researchers
- Alessandro Biondi
- one of the paper's researchers
- Cristiano Giuffrida
- one of the paper's researchers
Companies
- Intel
- the CPU vendor used in the proof-of-concept system
- Mozilla
- the company that was said to have considered IBPB-based mitigations
Organisations
- VUSec
- one of the research groups that disclosed the variant
- Scuola Superiore Sant'Anna
- one of the research groups that disclosed the variant
Products and systems
- SpiderMonkey
- Mozilla Firefox's JIT engine that was tested
- Mozilla Firefox
- the browser whose JIT engine was tested
- GraalVM
- a JIT engine and runtime that was tested
- Linux kernel
- the kernel said to be affected and later patched
- cBPF JIT
- the Linux kernel JIT component that was tested
How the source tells it
Mostly technical and explanatory, but it briefly leant into alarm and urgency through the proof-of-concept exploits and the emphasis on compromise within minutes.
- alarm the proof-of-concept exploits were presented against a fully patched Intel system with default protections enabled
- urgency the article stressed that the root password hash could be recovered within minutes