TL;DR Researchers at VUSec have published full details and proof-of-concept code for Branch Target Reuse (BTR), a new Spectre-v2 attack on just-in-time (JIT) compilers. Their end-to-end exploit leaked the Linux root password hash from kernel memory on modern Intel CPUs, bypassing all enabled mitigations. The Linux kernel has patched the issue under CVE-2026-64507 and CVE-2026-64508. Why the Branch Target Reuse Attack Matters…

Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines.

Researchers discovered a way to bypass recent Spectre v2 mitigations on Intel and AMD processors by exploiting a Time-of-Neutralization to Time-of-Use window. Their attack can leak sensitive Linux kernel data, including hashed passwords from /etc/shadow, and was presented at Black Hat USA by MIT CSAIL researchers Daniël Trujillo and Mengjia Yan. #SpectreV2 #BranchTargetInjection #Linux #Intel #AMD #MITCSAIL #BlackHatUSA

An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchers Daniël Trujillo and Mengjia Yan named the technique INTERRUPT INJECTION. On an AMD Zen 2 machine running Linux 6.14 with every default Spectre v2 mitigation on,

Des chercheurs ont découvert une faille considéréecomme le premier exploit natif Spectre v2. Elle affecte les systèmes Linux avec un CPU Intel (CVE-2024-2201).