A Familiar Threat Re-emerges
The notorious Spectre security vulnerability, which previously forced chip manufacturers into a desperate search for solutions several years ago, has reportedly surfaced once more. A collaborative team of security experts from Vrije Universiteit in the Netherlands and Scuola Superiore Sant'Anna in Italy has released a report outlining a novel attack vector dubbed Branch Target Reuse (BTR).
The researchers characterize BTR as the first practical in-place Spectre v2 attack specifically targeting just-in-time (JIT) compilers.
Understanding Speculative Execution and JIT
To grasp the implications, it is necessary to understand how modern microprocessors function. They utilize a feature known as «speculative execution», which anticipates the subsequent actions of a program and pre-loads them to accelerate overall performance. By identifying and remembering recurring patterns, processors aim to optimize speed, but this behavior creates vulnerabilities known as side-channel attacks. These allow malicious actors to extract sensitive data by analyzing indirect signals like system timing or power consumption.
The emergence of Spectre and Meltdown in 2017 highlighted these flaws, leading to a massive, albeit often problematic, industry-wide effort to deploy software patches. While those initial vulnerabilities were addressed, researchers have since identified numerous variants.
The Mechanics of Branch Target Reuse (BTR)
The BTR vulnerability revolves around the Branch Target Buffer (BTB), where processors store recurring execution patterns. Complications arise due to the JIT compiler, which translates code into machine instructions while a program is actively running, rather than beforehand.
The issue occurs when the JIT compiler removes code from a specific memory address and replaces it with new data. Because the CPU continues to attempt to jump to the original location based on established patterns, a window of exploitation is created. As the researchers note, this process is particularly concerning because it does not strictly require the deployment of new malware; attackers can exploit the fact that machine-code bytes may be interpreted differently depending on the execution offset.
Proof of Concept and Mitigation
In their research, the team successfully demonstrated two proof-of-concept exploits targeting Intel-based Linux systems. These exploits were capable of revealing root password hashes despite existing defenses like cBPF. The potential data leakage rate is estimated at approximately 5.4 to 5.7 KB/sec—a speed described as «slow but enough for an unprivileged user to coax a sensitive password hash out of a vulnerable system.»
Following the discovery, the vulnerabilities have been assigned tracking identifiers CVE-2026-64507 and CVE-2026-64508. Developers for the Linux kernel, along with Oracle, have already released necessary mitigations. While security teams are currently evaluating the performance trade-offs of these fixes, experts strongly advise users to prioritize system updates:
«Update your OS and software as soon as vendor patches are available,» the researchers emphasized.
The full technical paper regarding Branch Target Reuse has been peer-reviewed and is scheduled to be presented at the ACM CCS 2026 academic conference in The Hague this November.