Новая разновидность проблемы Spectre v2 угрожает процессорам Intel, AMD и Arm

Researchers from VUSec (Vrije Universiteit Amsterdam and Scuola Superiore Sant'Anna) have disclosed a new side-channel technique called Branch Target Reuse (BTR), a fresh variant of the Spectre v2 family that targets JIT compilers in browsers, runtimes and operating system kernels. The flaw arises when a JIT engine frees a memory region and places new code at the same address, causing the CPU's branch predictor to keep an outdated indirect-branch target and speculatively execute attacker-controlled instructions from the new code — a technique the team dubs 'speculative execute-after-free'.

Using two working proof-of-concept exploits against Linux cBPF on Intel hardware, the researchers leaked arbitrary memory at roughly 8 bytes per second and recovered the root password hash from a running su process in minutes, even on systems with constant blinding protection enabled. Tests on Raptor Cove and Lion Cove cores took about three and five minutes respectively, and the underlying predictor desynchronization was confirmed across Intel, AMD, and Arm CPUs; attempts against SpiderMonkey/Firefox and Oracle GraalVM showed the effect but no full working exploit was produced there.

The root-cause bugs in the Linux kernel were assigned CVE-2026-64507 and CVE-2026-64508 and have already been patched upstream, while Oracle added its own mitigations and Mozilla is relying on completing site isolation rollout. The team notes that stricter defenses like Indirect Branch Predictor Barrier (IBPB) can hinder the attack but hurt performance, and that only hardware-level redesign can fully eliminate this class of Spectre-style flaws.