BTR Spectre v2 Variant Can Leak Linux Root Password Hashes in Minutes

Summary

Researchers say BTR, a Spectre v2 variant, recovered a Linux root password hash in 3–5 minutes in tests on Intel CPUs. Linux kernel fixes have been merged for CVE-2026-64507 and CVE-2026-64508.

Key points

Branch Target Reuse (BTR) exploits stale CPU branch-predictor state after JIT-compiled code is replaced at a reused memory address.
In Linux tests, researchers used unprivileged classic BPF programs to infer data byte by byte and recover a running su process’s root password hash.
The researchers report average recovery times of three minutes on Raptor Cove and five minutes on Lion Cove CPUs; a hash is not the plaintext password.
The Linux cBPF exploit also worked with constant blinding enabled, using an adapted technique.
Tests found stale predictions in Firefox SpiderMonkey, but did not demonstrate a complete browser exploit. In GraalVM, researchers found a way to speculatively skip a sandbox check but could not complete an attack in their experiments.
Linux kernel fixes for CVE-2026-64507 and CVE-2026-64508 have been merged. Users are advised to apply OS and firmware updates and Linux users to upgrade to the latest kernel.

Article Details

Vulnerability Types: Speculative execution side-channel attack exploiting stale branch-predictor state after JIT code reuse
Exploitation Status: unknown
Exploit Availability: public_poc
Patch Status: partial
Workarounds: Apply OS and firmware updates; Linux users are advised to upgrade to the latest kernel version.