Reported by 5 outlets

Timeline

1. original reporting

   Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks

   securityweek.com · 14d ago · September 29th, 2026

   Researchers from the VUSec group at Vrije Universiteit Amsterdam in the Netherlands and Scuola Superiore Sant’Anna in Italy have disclosed a new variant of the Spectre v2 attack that affects systems powered by Intel, AMD, and Arm CPUs. The researchers named it Branch Target Reuse (BTR) , and it targets the just-in-time (JIT) compilers relied upon by operating system kernels, web browsers, and runtimes. An attacker able to run code on a targeted machine could exploit BTR to steal sensitive data from memory, such as password hashes. Attacks launched from malicious web pages also appear feasible, but the researchers have yet to build a complete browser exploit. Spectre v2 BTR exploits how processors handle code that changes at runtime. “The key insight behind the attack is that, while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries (i.e., branch targets),” the researchers explain. In JIT engines, these stale predictions can outlive the code they were created for. They can later be reused once new code is written to the same memory. This results in what the researchers call a speculative execute-after-free primitive, which lets an attacker hijack speculative execution into the new code at obsolete offsets. The researchers analyzed Linux cBPF, Oracle’s GraalVM runtime, and SpiderMonkey, the JavaScript and WebAssembly engine in Firefox. They developed two end-to-end exploits agains

2. update from git.kernel.org

   CVE-2026-64507: x86/bugs: Enable IBPB flush on BPF JIT allocation

   git.kernel.org · 81d ago · July 25th, 2026

   The Linux kernel CVE team announced this fix on 2026-07-25, two months before the VUSec public disclosure. The kernel issues an IBPB flush when BPF JIT memory is reused, skipped when the BPF dispatcher already uses a retpoline, and guarded by CONFIG_BPF_JIT. The issue was introduced in kernel 5.18 and is fixed in 6.1.183, 6.6.145, 6.12.97, 6.18.39, 7.1.4, and mainline 7.2, touching arch/x86/kernel/cpu/bugs.c and arch/x86/include/asm/nospec-branch.h.

3. update from git.kernel.org

   CVE-2026-64508: bpf: Support for hardening against JIT spraying

   git.kernel.org · 81d ago · July 25th, 2026

   Allocations larger than a pack are not covered, which the announcement states is safe because unprivileged cBPF programs are bounded well below a pack size. Fixed in the same stable versions (6.1.183, 6.6.145, 6.12.97, 6.18.39, 7.1.4, 7.2), affecting kernel/bpf/core.c and include/linux/filter.h.

4. update from github.com

   [GR-77766] Randomize runtime code cache mappings with allocator hints

   github.com · 55d ago · August 19th, 2026

   Oracle merged this change into GraalVM's master branch on 2026-08-19, randomizing runtime code cache mappings with allocator hints. VUSec's Branch Target Reuse page cites this pull request as Oracle's deployed GraalVM mitigation, which hinders JIT code-cache region reuse instead of adding predictor flushes. It landed about six weeks before the research went public.

5. update from bleepingcomputer.com

   Spectre v2 attack variant leaks Linux root password hash in minutes

   bleepingcomputer.com · 14d ago · September 29th, 2026

   A new Spectre v2 attack variant called Branch Target Reuse (BTR) can recover root password hashes from Intel computers running Linux in just a few minutes. By manipulating this leftover information, an attacker can trick the processor into temporarily executing the wrong instructions and potentially expose sensitive data. VUSec’s Cristiano Guiffrida explained to BleepingComputer that this attack remains an important finding, considering that since 2018 the field assumed that these kinds of attacks were not practical due to self-modifying code (SMC) serving as the basis for dynamic code generation in commodity JIT engines. BTR demonstrates the opposite, showing that SMC-based transient execution attacks are practical in real-world environments and can be used to leak the hash for the root password. The researchers notified the affected vendors, and the issues received the identifiers CVE-2026-64507 and CVE-2026-64508.

6. update from thehackernews.com

   🤖 New Spectre-v2 variant "Branch Target Reuse" (BTR): stale indirect branch targets survive JIT code-cache rewrites, giving a transient exec

   thehackernews.com · 14d ago · September 29th, 2026

   🤖 New Spectre-v2 variant "Branch Target Reuse" (BTR): stale indirect branch targets survive JIT code-cache rewrites, giving a transient exec

   via Mastodon https://thehackernews.com/2026/09/new-spectre-v2-btr-attack-leaks-linux.html