Branch Target Reuse Spectre-v2 Attack: Full Details and PoC Code Released

TL;DR

Researchers at VUSec have published full details and proof-of-concept code for Branch Target Reuse (BTR), a new Spectre-v2 attack on just-in-time (JIT) compilers. Their end-to-end exploit leaked the Linux root password hash from kernel memory on modern Intel CPUs, bypassing all enabled mitigations. The Linux kernel has patched the issue under CVE-2026-64507 and CVE-2026-64508.

Why the Branch Target Reuse Attack Matters

JIT engines sit inside web browsers, language runtimes, and the operating system kernel. The researchers studied three of them: Linux cBPF, Oracle GraalVM, and SpiderMonkey, the JavaScript engine in Firefox.

The hardware problem is broad. According to the VUSec Branch Target Reuse project page, “No current CPU has a mechanism to keep the two in sync, so until vendors add one, your CPU is vulnerable.” The team confirmed the behavior on every CPU it tested, from Intel, AMD, and Arm.

The kernel target also matters. Unprivileged programs can still use classic BPF (cBPF). It powers seccomp filters and packet filtering in tools such as Docker and Chrome.

How the Attack Works

Modern CPUs guess where indirect jumps will land and store those guesses in the branch target buffer. JIT engines create and delete code in memory all the time. VUSec explains the core insight: “while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries.”

As a result, an old branch prediction can outlive the code it pointed to. When the JIT engine later places new code at the same address, the CPU may speculatively jump to the stale target. The researchers call this a “speculative execute-after-free primitive.” It lets an attacker steer speculative execution into code at unexpected offsets and leak secrets through side channels.

The Linux Kernel Exploit

The team built a full exploit against Linux cBPF. It leaks memory at about eight bytes per second. That rate sounds slow, but targeted pointer chasing keeps the needed data small. In the demo, the exploit walked kernel structures to find and leak the root password hash. BleepingComputer reports that this took three to five minutes on average on the tested Intel processors.

The researchers also bypassed the kernel’s optional cBPF constant-blinding hardening, which is off by default.

Firefox and GraalVM

In SpiderMonkey, a proof of concept achieved speculative code execution on Intel CPUs. However, VUSec notes that “turning this into an end-to-end browser exploit requires further work.” In GraalVM, the engine’s own garbage collection wiped the needed branch entries before the attack could use them.

Public Proof-of-Concept and Exploitation Status

The technical details and exploit code are now public. VUSec released its Branch Target Reuse research paper, accepted at ACM CCS 2026, along with the BTR proof-of-concept code on GitHub. No exploitation in the wild has been reported.

Affected Systems and Mitigations

Hardware vendors told the researchers that existing mechanisms such as IBPB already help, and that fixes belong in software. The Linux kernel added two fixes:

• CVE-2026-64507: issues an IBPB flush on all cores when a cBPF program reuses a previously executed JIT region.
• CVE-2026-64508: adds support for hardening against JIT spraying.

Oracle now randomizes GraalVM JIT code-cache locations. Mozilla is focusing on finishing site isolation in Firefox instead of IBPB-based fixes.

Update your kernel and software as soon as patches reach your distribution. Features such as Intel IBT and Arm BTI “raise the bar, but do not eliminate the risk,” according to VUSec. Because Branch Target Reuse affects every CPU the team tested, software patches remain the main defense.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.