New BTR Spectre-v2 Attack Leaks Linux Kernel Memory and Steals Root Password Hashes

A newly disclosed Branch Target Reuse (BTR) attack technique abuses stale indirect-branch predictions in just-in-time (JIT) code to leak sensitive data from Linux kernel memory.

An end-to-end proof of concept demonstrated recovery of a root password hash from the memory of the su process on modern Intel systems, despite enabled mitigations.

BTR targets a gap between the processor’s architectural view of code and the prediction state held in its Branch Target Buffer (BTB). Modern processors correctly restore code coherence after code is modified, freed, or replaced.

New BTR Spectre-v2 Attack Leaks Linux Kernel Memory

However, they may retain stale BTB entries that point to an older indirect-branch destination. When JIT memory is recycled, an attacker can arrange for new code to occupy part of the old region, then induce the CPU to speculatively execute from the stale target.

The result is effectively a speculative execute-after-free primitive. The processor transiently follows an obsolete prediction into newly generated attacker-influenced code, where a disclosure gadget can expose secret-dependent data through microarchitectural side channels.

Architectural execution is ultimately corrected, but cache-state traces created during speculation can be measured to reconstruct the leaked value.

Vusec built a complete exploit against Linux’s classic Berkeley Packet Filter, or cBPF, JIT compiler. The attack creates two seccomp-filter programs: a training program and a target program.

First, the attacker installs and executes the training program to populate the BTB with an indirect-branch target. The attacker then removes that program and causes the JIT engine to allocate the target program in a partially reused memory region.

When the same indirect branch is triggered again, the CPU may speculatively jump to the former training-program entry point. At that address, the memory now contains portions of the target program.

By positioning a gadget inside four-byte immediate values and entering it at a misaligned offset, the researchers achieved speculative execution of attacker-controlled disclosure logic. The proof of concept reportedly leaked roughly eight bytes per second.

That throughput was sufficient because the exploit used pointer chasing: it walked the Linux kernel task list, identified the target process by PID, accessed its memory-management structures, traversed mapped pages, and searched for the root password hash loaded by su.

Vusec also bypassed Linux cBPF constant blinding, an optional runtime defense controlled by the bpf_jit_harden setting. Rather than placing attacker-controlled bytes in immediate values, the technique encodes useful instruction bytes in forward-jump offsets.

The same byte stream remains valid cBPF code when normally aligned but becomes a speculative dispatch gadget when execution begins two bytes later.

This matters because cBPF remains reachable by unprivileged processes through seccomp and Linux socket-filtering paths, even where the more capable eBPF JIT is restricted.

The attack therefore presents a meaningful local attack surface for systems that permit untrusted code execution. BTR was also evaluated against Mozilla Firefox’s SpiderMonkey and Oracle GraalVM.

In SpiderMonkey, Vusec found that stale BTB entries could survive JIT code deallocation and reallocation, enabling speculative jumps into WebAssembly literal pools and potentially speculative arbitrary code execution. An end-to-end browser exploit was not completed.

In GraalVM, BTR could speculatively bypass masking operations intended to constrain sandboxed guest-code memory accesses. Oracle mitigated this exposure by randomizing JIT code-cache locations, making reliable region reuse harder.

Patches and Mitigation

Linux kernel developers addressed the issue through CVE-2026-64507 and CVE-2026-64508. The kernel fix introduces an Indirect Branch Prediction Barrier (IBPB) flush on x86 when BPF JIT memory is reused, preventing stale branch-prediction entries from being carried into a newly allocated JIT region.

The hardening applies when BPF JIT is in use and Spectre-v2 protections are active.security-tracker. Administrators should deploy current kernel updates and track vendor guidance for affected JIT runtimes.

IBT on x86 and BTI on Arm can raise exploitation complexity, but the researchers state they do not universally eliminate BTR risk because speculative execution may occur before target validation or reach attacker-created valid landing sequences.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team