New Spectre v2 attack variant leaks Linux root password hash in minutes

Researchers from VUsec and Scuola Superiore Sant'Anna disclosed a new speculative-execution attack dubbed Branch Target Reuse (BTR), a variant of Spectre v2, tracked as CVE-2026-64507 and CVE-2026-64508. The technique abuses stale entries in a CPU's branch predictor left over when a JIT engine reuses memory for new self-modifying code, tricking the processor into briefly executing attacker-controlled instructions and leaking data through cache side channels. Using unprivileged classic BPF programs on Linux, the team showed they could pull a running 'su' process's root password hash out of memory at roughly eight bytes per second, fully recovering it in about 3 to 5 minutes on Intel's Raptor Cove and Lion Cove cores, and they confirmed the same weakness affects Intel, AMD and Arm processors. Firefox's SpiderMonkey and Oracle's GraalVM were also found susceptible to related stale-prediction effects, though no full exploit chain was completed there. Fixes have already landed in the Linux kernel, and users are urged to install the latest OS, firmware and kernel updates.