New Spectre v2 Variant BTR Exposes JIT Engines to Data Leaks

• •The Branch Target Reuse (BTR) attack targets JIT compilers in multiple CPU architectures.
• •Exploits can leak sensitive data like root password hashes from Intel-based Linux systems.
• •Patches have been released, but the attack demonstrates the ongoing risks of speculative execution vulnerabilities.

Researchers from Vrije Universiteit Amsterdam and Scuola Superiore Sant’Anna have disclosed a new Spectre v2 variant called Branch Target Reuse (BTR), affecting JIT compilers in browsers and operating system kernels across Intel, AMD, and Arm CPUs. This attack exploits stale indirect branch prediction entries, allowing attackers to hijack speculative execution and leak sensitive data, such as root password hashes, from memory. Two proof-of-concept exploits have been demonstrated against Linux cBPF, leaking data at a rate of 8 bytes per second. The vulnerabilities have been assigned CVE-2026-64507 and CVE-2026-64508, with patches already integrated into the Linux kernel. The attack is particularly concerning as it can be executed from unprivileged code in JIT engines. The researchers have notified affected vendors, and mitigations are being assessed for performance trade-offs.