CVE-2026-64508
bpf: Support for hardening against JIT spraying
No known exploitation. EPSS puts it in the 8th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 1fbafd5235ca897b322161659ebe8ba651b00b3bUpgrade to: 1fbafd5235ca897b322161659ebe8ba651b00b3bAffected: ≥ 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 6e52c240c43a601b681e3a4e58fc5685114d4726Upgrade to: 6e52c240c43a601b681e3a4e58fc5685114d4726Affected: ≥ 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < eed774da601268dae674e14d54a15e3624691f52Upgrade to: eed774da601268dae674e14d54a15e3624691f52Affected: ≥ 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 8ff183ee4d8c452960df58175a094828c0513b2eUpgrade to: 8ff183ee4d8c452960df58175a094828c0513b2e + 2 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
Coverage timeline
3 publishersTechnical analysis published
Sourced from public security reporting — each date is when it was published, not when it happened.
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 8th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
6 events over 25 days, from the signal feeds we watch.
- Record updated
- Record updated
- OpenVAS check added
- Record updated
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/1fbafd5235ca897b322161659ebe8ba651b00b3b
- git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726
- git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37
And 3 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI