Academic researchers have disclosed Branch Target Reuse (BTR), a new Spectre v2 variant that targets just-in-time (JIT) compilers in web browsers, language runtimes and operating system kernels, SecurityWeek reported Tuesday. The researchers say every Intel, AMD and Arm processor they tested is affected, and a Linux kernel exploit recovered a root password hash within minutes.

What Happened

BTR was found by the VUSec group at Vrije Universiteit Amsterdam and researchers at Scuola Superiore Sant'Anna in Italy. It targets a gap in how processors handle code that is modified while running, which is exactly what JIT compilers do when they generate machine code on the fly and later reuse the same memory for new code.

When code changes, modern CPUs restore coherence so the processor executes the new instructions. But the researchers found that the indirect branch predictor, which guesses where jumps will land, does not necessarily discard predictions tied to the old code. An attacker who can influence those stale entries can steer speculative execution toward instructions of their choosing and read secrets out through cache side channels, one byte at a time.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The team demonstrated a Linux kernel exploit that uses classic BPF (cBPF) programs, which the kernel JIT-compiles. On Intel hardware it leaked 8 bytes per second. BleepingComputer reported that the end-to-end exploit extracted the root password hash in about three minutes on average on Intel's Raptor Cove cores and five minutes on Lion Cove cores. A proof of concept against Firefox's SpiderMonkey engine was not complete, but the researchers estimate it could reach dozens of bytes per second.

BleepingComputer said two CVE identifiers, CVE-2026-64507 and CVE-2026-64508, have been assigned, and that fixes are already merged into the Linux kernel.

Why It Matters

JIT compilers sit in some of the most exposed software on a machine. Browsers run untrusted JavaScript through them, and the Linux kernel compiles BPF programs that unprivileged users can sometimes load. A flaw that turns routine code reuse into a data leak affects a wide range of systems, not only a single vendor's chips.

The researchers argue the root cause is architectural: no current CPU keeps branch predictors synchronized with modified code, so software mitigations are the only defense until chip designers add such a mechanism. They also said hardware control-flow protections, such as Intel's Indirect Branch Tracking and Arm's Branch Target Identification, make exploitation harder but do not stop it.

Vendor Responses and Mitigations

AMD said the research did not reveal a new vulnerability and that existing Spectre v2 mitigations are adequate. Intel and Arm had not commented publicly when SecurityWeek published.

Software vendors have moved on their own. Linux added an x86 mitigation that issues an indirect branch prediction barrier (IBPB) across all CPU cores when cBPF programs reuse memory. Oracle has shipped mitigations for GraalVM, its polyglot runtime. Mozilla is prioritizing completion of site isolation in Firefox rather than relying on IBPB-based fixes.

Context

Spectre-class flaws have recurred since the original disclosures in 2018, as researchers keep finding paths around hardware and software defenses built after each round. BTR follows that pattern: it reuses a known primitive, branch target injection, and applies it to a code path that earlier mitigations did not fully cover.

What to Watch

Administrators should install current kernel, firmware and browser updates. Formal guidance from Intel and Arm is still outstanding, and the Firefox exploit path depends on how quickly Mozilla finishes its site-isolation work. Other JIT-based runtimes that were not part of the research may also need review.