New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses

Summary: Academics from VUSec and Scuola Superiore Sant'Anna disclosed a new Spectre v2 variant called Branch Target Reuse (BTR) that exploits stale indirect branch prediction entries left behind when JIT engines rewrite code, affecting SpiderMonkey, GraalVM, and the Linux kernel's cBPF JIT. Two proof-of-concept exploits against the Linux kernel leaked and recovered the root password hash within minutes from a fully patched Intel system with default protections enabled.
What you should know: The attack worked on a fully patched Intel system with default protections on, and the researchers say it undermines existing mitigations including those for Training Solo (CVE-2024-28956 and CVE-2025-24495) - so the patch status you are relying on may not cover this class of leak.

Read the original at The Hacker News ↗