New Spectre-v2 BTR Attack Bypasses Linux Kernel Defenses
Researchers demonstrate password hash leaks on patched Intel systems
1New Spectre variant discovered
Academic researchers from VUSec and Scuola Superiore Sant'Anna have identified a new Spectre-v2 variant called Branch Target Reuse (BTR). This vulnerability affects JIT engines in web browsers, language runtimes, and operating system kernels across multiple CPU vendors. The attack exploits how modern CPUs handle stale indirect branch prediction entries, allowing attackers to bypass existing Spectre mitigations.
2JIT engine vulnerability mechanism
BTR works by exploiting stale branch prediction entries that outlive original code in JIT engines. When code caches are repopulated, these stale targets can be reused, creating a transient execute-after-free primitive. This enables attackers to hijack control flow to newly generated code at obsolete offsets, bypassing software hardening measures or reaching misaligned gadgets in the execution pipeline.
3Affected systems
Researchers tested BTR against Mozilla Firefox's SpiderMonkey JIT, GraalVM, and Linux kernel's cBPF JIT - all were vulnerable but with varying exploitability. A proof-of-concept demonstrated root password hash leaks from fully patched Intel systems within minutes. The attack requires unprivileged code execution in a JIT engine to disclose sensitive host environment data.
4Spectre background
Spectre vulnerabilities, first discovered in 2017, exploit CPU speculative execution optimizations. Attackers trick processors into speculatively accessing sensitive data, then infer it through cache timing side channels. Spectre v2 specifically abuses indirect branch prediction, poisoning this mechanism to execute attacker-controlled code speculatively while measuring cache changes.
5Key attack requirements
BTR requires two specific conditions: stale BTB entries must persist after JIT engine frees training chunks, and the branch predictor must select these stale entries. The attack redirects control flow to architecturally invalid points, bypassing Spectre hardening or executing misaligned instructions to ultimately disclose secret data through side channels.
6Current mitigation status
Following responsible disclosure, Linux kernel patches (CVE-2026-64507/8) have been released. GraalVM implemented randomization of JIT code-cache locations to hinder region reuse. Mozilla is prioritizing site isolation over IBPB-based mitigations. These updates come shortly after MIT CSAIL's Interrupt Injection attack that also bypassed Spectre v2 defenses.
7Enterprise security implications
The disclosure highlights growing challenges as AI agents gain broader system access while security controls lag. Attackers increasingly use AI for reconnaissance and privilege escalation. Runtime identity controls are becoming critical defenses against such advanced speculative execution attacks that bypass traditional mitigations.
8Ongoing security challenges
BTR demonstrates how fundamental CPU optimizations continue yielding novel attack vectors years after initial discoveries. The security community faces an arms race between new speculative execution variants and mitigation techniques. This case particularly impacts environments relying on JIT compilation, requiring ongoing vigilance and layered defenses against microarchitectural attacks.
Original article: The Hacker News — New Spectre-v2 BTR Attack Bypasses Linux Kernel Defenses