VUSec Unveils 'Branch Target Reuse' (BTR): New Spectre-v2 Attacks on JIT Engines via Stale Branch Predictions

Image source: https://www.vusec.net/projects/btr/

On September 29, 2026, security researchers from Vrije Universiteit Amsterdam's VUSec group and Italy's Scuola Superiore Sant'Anna officially disclosed 'Branch Target Reuse' (BTR), a novel Spectre-v2 attack technique targeting Just-In-Time (JIT) compilation environments. Accepted for presentation at ACM CCS 2026, the research highlights how CPU branch prediction entries remain unsynchronized when dynamic code generation engines free and reuse code-cache memory.

JIT compilers, which underpin modern web browsers, language runtimes, and operating system kernels, rely on Self-Modifying Code (SMC) to generate executable instructions dynamically. The researchers demonstrated that stale indirect branch prediction state left behind in CPU branch target buffers can be exploited to cause a transient execute-after-free primitive, bypassing memory isolation to leak kernel memory.

Core Mechanism of BTR: Code Cache Reuse and Stale Predictions

Modern processors implement architectural coherence mechanisms to ensure that overwritten or freed Self-Modifying Code (SMC) cannot be executed architecturally. However, the microarchitectural guarantees during speculative execution are far less complete.

Prior SMC-based transient execution primitives, such as SCSB, were confined to x86 and relied on extremely brief instruction/data-cache coherence windows, leading to a common assumption that transient execution attacks against production JIT engines were impractical. BTR overturns this assumption by introducing an in-place indirect branch exploitation technique.

• Transient Execute-After-Free: When a JIT engine frees a code-cache buffer and later repurposes it for new instructions, stale indirect branch target predictions can persist inside the CPU's Branch Target Buffer (BTB).
• Branch Target Desynchronization: By carefully orchestrating JIT allocations, an attacker can coerce the CPU's branch predictor into speculatively executing code at outdated branch targets, creating transient execution gadgets that leak sensitive data across security boundaries.

Attack Surface Analysis: Linux cBPF, SpiderMonkey, and GraalVM

The researchers evaluated the attack surface across systems powered by Intel, AMD, and ARM processors, analyzing several widely deployed JIT runtimes.

• Linux Kernel cBPF: The team developed a full end-to-end kernel memory leak exploit targeting unprivileged classic BPF (cBPF) JIT compilation in the Linux kernel. On fully patched Intel systems with default mitigations enabled, the exploit successfully extracted root password hashes from kernel memory within minutes.
• Firefox SpiderMonkey: In Mozilla Firefox's JavaScript engine, SpiderMonkey, researchers demonstrated the presence of branch prediction desynchronization upon code cache recycling, though the demonstration stopped short of a complete browser sandbox bypass exploit.
• Oracle GraalVM: The multi-language GraalVM runtime was also analyzed, confirming that its dynamic code generation structures share the architectural exposure to BTR primitives.

Mitigations and Vendor Responses (CVE-2026-64507, CVE-2026-64508)

Remediation efforts and vendor guidance have been coordinated across the affected software and hardware ecosystems.

The Linux kernel community merged patches addressing CVE-2026-64507 (enabling an Indirect Branch Prediction Barrier flush upon BPF JIT allocations on x86) and CVE-2026-64508 (hardening against JIT spraying attacks).

Intel published an official security advisory (INTEL-2026-10-01-001-BTR) on October 1, 2026, confirming that the reported behavior is mitigated by existing Intel guidance for Spectre-v2 variants—including Branch History Injection (BHI) mitigations—alongside the latest Linux kernel patches. To foster further research and validation, the VUSec team has released its microarchitectural experiments, attack surface analysis tools, and end-to-end exploit artifacts on GitHub (vusec/btr) and Zenodo.

Sources

• VUSec BTR Project: Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries
• ACM CCS 2026 Research Paper: download.vusec.net/papers/btr_ccs26.pdf
• GitHub Repository: vusec/btr
• Intel Security Advisory: INTEL-2026-10-01-001-BTR Announcement