Security researchers have disclosed a new Spectre-v2 attack called Branch Target Reuse (BTR), showing how stale CPU branch predictions can be abused to leak sensitive data from Linux systems.
Developed by researchers from VUSec at Vrije Universiteit Amsterdam and Scuola Superiore Sant’Anna, BTR targets environments that generate code dynamically, including JIT compilers. For Linux, the team focused on classic BPF (cBPF) and built two end-to-end exploits.
The basic idea is that modern CPUs try to predict where a program will execute next to improve performance. BTR abuses cases where those predictions remain in the processor even after the original code has been removed and the same memory has been reused.
If the CPU follows an outdated prediction, it may briefly execute new code from the wrong location. That speculative execution is discarded, but traces left behind can be measured and used to recover data that should not be accessible.
In their Linux demonstration, the researchers used cBPF to read arbitrary memory on modern Intel processors. The attack reached about 8 bytes per second and extracted the root password hash from memory used by the su process.
Importantly, that does not mean BTR can remotely steal a Linux root password. The attack requires an attacker to already run unprivileged code on the target system, and the researchers extracted a password hash, not the plaintext password.
One notable detail is that disabling unprivileged eBPF does not remove this attack surface. Classic BPF is still used by Linux for features such as seccomp and socket filtering, and by software including Docker and Chrome.
The researchers also tested BTR against Firefox’s SpiderMonkey engine and Oracle’s GraalVM. In Firefox, they demonstrated the technique through WebAssembly but did not build a full browser exploit. GraalVM showed exposure to the technique, though internal runtime behavior prevented a practical attack.
According to the researchers, the CPU behavior needed for BTR was observed across tested Intel, AMD, and Arm processors. However, the complete Linux cBPF exploit targets Intel systems and should not be taken to mean the same attack works identically across all architectures.
The good news is that Linux includes mitigations for the issue. Kernel developers added protections that flush branch prediction state when BPF JIT memory is reused and introduced hardening against JIT spraying. The related fixes are tracked as CVE-2026-64507 and CVE-2026-64508.
For more information, see this LinkedIn post.
