New Spectre v2 Variant (BTR) Affects Intel, AMD, Arm CPUs, Leaks Sensitive Data

New Spectre v2 Variant Identified

Researchers from the VUSec group at Vrije Universiteit Amsterdam and Scuola Superiore Sant’Anna in Italy have disclosed a new variant of the Spectre v2 attack, which they named Branch Target Reuse (BTR). This variant affects systems powered by Intel, AMD, and Arm CPUs.

The BTR attack targets just-in-time (JIT) compilers used by operating system kernels, web browsers, and runtimes. It exploits how processors handle code that changes at runtime, specifically focusing on stale indirect branch prediction entries.

Mechanism of the Attack

The core of the BTR attack lies in the observation that while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries. In JIT engines, these stale predictions can outlive the code they were created for and be reused when new code is written to the same memory.

This process creates a 'transient execute-after-free primitive,' allowing attackers to hijack transient control flow to newly generated code at obsolete offsets. This can bypass software hardening or reach misaligned gadgets, enabling the extraction of sensitive data.

Real-World Impact and Demonstrations

An attacker able to run code on a targeted machine could exploit BTR to steal sensitive data from memory, such as password hashes. The researchers demonstrated that BTR can recover root password hashes from Intel computers running Linux in just a few minutes.

Attacks launched from malicious web pages also appear feasible, though a complete browser exploit has not yet been built. The researchers evaluated BTR against Firefox's JavaScript engine SpiderMonkey, GraalVM, and the Linux kernel's cBPF JIT, finding all to be affected to varying degrees.

Significance and Mitigations

This discovery is significant because it demonstrates that self-modifying code (SMC)-based transient execution attacks are practical in real-world environments, a finding that challenges previous assumptions in the field since 2018. The attack shows that even fully patched Intel systems can be vulnerable.

Fixes for the identified vulnerabilities, tracked as CVE-2026-64507 and CVE-2026-64508, have been merged into the Linux kernel to address the BTR threat.