VUSec Researchers Disclose Spectre v2 BTR Attack Affecting Intel, AMD, Arm CPUs

September 29, 2026 at 10:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Researchers from VUSec and Scuola Superiore Sant'Anna disclosed a new Spectre v2 variant, Branch Target Reuse (BTR), affecting Intel, AMD, and Arm CPUs. The attack exploits stale branch prediction entries in JIT engines to leak sensitive data, including root password hashes from fully patched Linux systems. Proof-of-concept exploits leak 8 bytes per second and bypass default mitigations.

Key Facts

The BTR attack affects JIT engines in Linux cBPF, Oracle GraalVM, and Mozilla Firefox's SpiderMonkey.
Two end-to-end exploits against the Linux kernel leak the root password hash within minutes on a fully patched Intel system with default protections.
The exploit leaks 8 bytes per second, which researchers say is sufficient to reach secrets with careful pointer chasing.
Mozilla has not yet completed the rollout of site isolation in Firefox, increasing exposure to browser-based attacks.

Attack Mechanism

BTR exploits how processors handle self-modifying code in JIT engines. Modern CPUs restore architectural code coherence after self-modification but do not invalidate stale indirect branch prediction entries. These stale predictions can be reused when new code is written to the same memory, creating a speculative execute-after-free primitive. Attackers can hijack speculative execution into new code at obsolete offsets, bypassing software hardening.

Linux Kernel Exploit

The kernel exploits abuse classic BPF (cBPF), which remains accessible to unprivileged programs through seccomp, socket filtering, and packet filtering. On modern Intel CPUs, the exploit leaks arbitrary memory and bypasses all enabled mitigations. In a demonstration, researchers located and leaked the root password hash after it was loaded into memory. The exploit leaks 8 bytes per second, which researchers say is sufficient with careful pointer chasing.

Browser Exposure

In Firefox, an attacker could launch the attack from a malicious website running JavaScript in the victim's browser. Because Mozilla has not completed site isolation rollout, content from other tabs may share the attacker's address space. Proof-of-concept showed stale branch entries persist in SpiderMonkey on Intel processors long enough to be reused.