New Spectre variant exploits processor prediction behavior in just-in-time compilersResearchers demonstrated practical attacks against Intel-based Linux systemsVendors released mitigations as security teams assess performance tradeoffsThe dreaded Spectre vulnerability which had chip manufacturers scrambling for a fix a few years ago, has returned, experts have claimed.Security researchers from the Vrije Universiteit in the Netherlands and Scuola Superiore Sant’Anna in Italy published a new report, detailing a type of attack they call Branch Target Reuse (BTR).They labeled it the first practical in-place Spectre v2 attack that targets just-in-time (JIT) compilers - and it's a lot to decompile (pun intended), so let’s break it all down.Spectre and MeltdownModern microprocessors come with a feature called “speculative execution” - they speculate what a program’s next moves might be, and load them in advance, so that when one scenario actually happens, it can be executed rather quickly. They also monitor recurring patterns and try to remember them, but this also opens the doors to so-called “side-channel attacks”, which allow threat actors to steal information by observing indirect clues from a system (timing, power consumption, etc.), rather than accessing them directly. Back in 2017, security researchers discovered that speculative execution can be abused via side-channel attacks, giving birth to two vulnerabilities: Spectre and Meltdown. Given how widespread the flaws were (practically all chips were affected), and their potential severity, the entire industry rushed to fix the flaws with software patches. Some succeeded, but the overall effort was more of a fiasco than a success. Many chips were throttled significantly, and some computers were entirely bricked.Spectre and Meltdown were eventually fixed, but since then, there have been countless copycats and variants. We now have a new variant, called Branch Target Reuse (BTR).BTRWhen a processor wants to “remember” a recurring theme, it stores it in something called the Branch Target Buffer (BTB). At the same time, there is an element called “JIT”. Short for just-in-time, it is a compiler that translates code into native machine instructions during program execution, rather than before it runs. In practice, JIT creates code at memory address X, later running it numerous times. The CPU learns the pattern and tries to repeat it.So when JIT deletes the code and puts something else at the same address X, that’s where the problems begin, since the CPU still tries to jump to X first. That is called Branch Target Reuse. The CPU will eventually realize that the old habits no longer work, but it’s the moment in between that the researchers managed to exploit.What makes BTR particularly dangerous is the fact that there is no need for a new malware to exploit it. Threat actors can simply use the fact that machine-code bytes can mean different things when execution begins at a different byte offset. In the paper, the researchers detail two proof-of-concept (PoC) exploits that can target Intel-based Linux kernels, revealing the root password hash even with the constant binding defense provided by cBPF. The expected leakage rate is 5.7 KB/sec for Intel Raptor Cove chips and 5.4 KB/sec for Lion Cove which, according to The Register, is “slow but enough for an unprivileged user to coax a sensitive password hash out of a vulnerable system.”Linux kernel developers and Oracle responded with mitigations. The bugs have now gotten two CVEs: CVE-2026-64507 and CVE-2026-64508. Mozilla decided to focus more on site isolation, and while IBPB is most likely effective, it will slow the machine down. “Update your OS and software as soon as vendor patches are available,” the researchers said. “Both the Linux kernel and Oracle have released patches.”The Branch Target Reuse paper, which can be read on this link, was peer-reviewed and accepted by ACM CCS 2026, a major academic cybersecurity conference, due to take place in mid-November this year in The Hague, Netherlands. Via The Register