New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses

Researchers from VUSec and Scuola Superiore Sant'Anna have published a new Spectre v2 branch-prediction attack they call Branch Target Reuse (BTR), which works against JIT compilers even when existing speculative-execution protections are in place. The flaw stems from CPUs failing to clear stale indirect-branch-prediction entries when self-modifying JIT code is freed and reallocated, letting an attacker redirect transient execution to invalid code locations and leak secrets. The team demonstrated working exploits against the Linux kernel's cBPF JIT, Mozilla Firefox's SpiderMonkey engine, and Oracle's GraalVM, including two proof-of-concept attacks that recovered a root password hash within minutes on a fully updated, default-hardened Intel Linux machine. The issue has been assigned CVE-2026-64507 and CVE-2026-64508, with kernel fixes already merged, while GraalVM now randomizes JIT code-cache placement and Mozilla is leaning on site isolation rather than IBPB-based mitigation.