Loading story…
Researchers at VUSec and Scuola Superiore Sant’Anna disclosed Branch Target Reuse (BTR), a Spectre-v2-class attack that abuses stale indirect-branch predictor entries after JIT-generated code is freed and its cache region reused. The resulting speculative execute-after-free condition can redirect transient execution and expose secrets through cache side channels. Tests found the issue across evaluated Intel, AMD, and Arm CPUs and in JIT environments including Linux cBPF, Firefox SpiderMonkey, and Oracle GraalVM.
Two end-to-end exploits against Linux’s cBPF JIT leaked arbitrary kernel memory on fully patched Intel systems with default mitigations enabled, recovering a root password hash within minutes at roughly 8 bytes per second. Linux has released and backported cBPF hardening tracked as CVE-2026-64507 and CVE-2026-64508; mitigations use indirect branch prediction barriers on x86. GraalVM is randomizing JIT code-cache locations, while Mozilla is prioritizing Firefox site isolation after evaluating IBPB-based defenses. Researchers warned that existing hardware lacks a general mechanism to synchronize branch-prediction state with modified runtime code.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The researchers demonstrated two end-to-end exploits against Linux cBPF JIT that bypassed enabled mitigations on a modern Intel system with default protections. The exploits leaked arbitrary memory, including a root password hash, at approximately 8 bytes per second.
VUSec and Scuola Superiore Sant'Anna publicly disclosed BTR after the embargo lifted. The Spectre-v2-class technique was observed on tested Intel, AMD, and Arm CPUs and affects JIT implementations including Linux cBPF, Firefox SpiderMonkey, and Oracle GraalVM.
Linux added IBPB flushing when BPF JIT code is allocated in memory previously used for executed BPF code, alongside BPF JIT-spraying hardening. The mitigations were mainlined and backported to stable kernels before public disclosure, and are tracked as CVE-2026-64507 and CVE-2026-64508.
Researchers privately disclosed Branch Target Reuse (BTR) information to Linux kernel developers. BTR abuses stale indirect-branch-prediction targets after JIT code is modified or reused, creating a speculative execute-after-free primitive.
Oracle deployed mitigations including JIT code-cache randomization to hinder address-region reuse in GraalVM. Mozilla evaluated IBPB-based mitigations for SpiderMonkey but prioritized completing Firefox site isolation; researchers had shown persistent stale branch entries in SpiderMonkey but no complete browser exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcephoronix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from MIT CSAIL disclosed an **interrupt injection** attack that can bypass Linux’s `Safe RET` mitigation for Spectre-class attacks on **AMD Zen 1 through Zen 4** processors, potentially allowing information disclosure from kernel memory. AMD acknowledged the issue in its **Return Address Security Bulletin** and said the weakness stems from Linux’s implementation of the mitigation for **Speculative Return Stack Overflow (SRSO)** rather than the processor architecture alone. The flaw lets an attacker with code execution on a target system precisely time an interrupt to disrupt branch predictor sanitization and weaken the intended protection. Linux has already patched the issue in the latest kernel Git code by addressing the handling of interrupts around the `Safe RET` mitigation path. The researchers reported demonstrating arbitrary kernel memory leakage on **AMD Zen 2** systems running Linux with default Spectre v2 defenses, achieving **5.47 bytes per second** at **91.97% accuracy** and reading `/etc/shadow` in five of ten attempts. The work was reported by **Daniël Trujillo** of MIT CSAIL, presented at **Black Hat USA**, and accompanied by a proposed fix that adds a second predictor neutralization step on interrupt return; researchers also said related misprediction behavior was observed on some Intel systems, though AMD is the vendor that formally assigned and documented the vulnerability.
Aug 12, 2026
Researchers disclosed the **Spectre** and **Meltdown** CPU side-channel attacks, showing that speculative and out-of-order execution can transiently bypass security checks and leave protected data observable through microarchitectural state such as processor caches. The flaws affect isolation boundaries intended to protect kernel, process, and virtual-machine memory; Meltdown is tracked as `CVE-2017-5754` and primarily affects Intel processors, while Spectre variants affect a broader range of Intel, AMD, and ARM designs. Spectre Variant 2, `CVE-2017-5715`, uses branch-target injection to induce privileged code to speculatively access data and expose it through cache behavior, potentially crossing syscall and guest/host boundaries. Red Hat rated the vulnerability **Important** with a CVSS v3 score of 5.6 and released kernel fixes for supported Red Hat Enterprise Linux 5, 6, and 7 streams; organizations should apply vendor firmware, kernel, and virtualization mitigations appropriate to their processors and workloads.
Aug 28, 2026
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026