Security researchers have demonstrated Branch Target Reuse, a Spectre v2 variant that exposes sensitive information through outdated processor predictions. In Linux experiments on two Intel architectures, the team recovered a root password hash within three to five minutes on average.
The result does not mean attackers can instantly obtain the password itself. However, a stolen hash allows them to attempt password cracking offline.
Linux Tests Demonstrate Sensitive Data Exposure
Researchers from VU Amsterdam’s VUsec group and Scuola Superiore Sant’Anna developed the attack. Their strongest demonstration targeted the Linux kernel’s classic Berkeley Packet Filter, or cBPF.
During testing, the team used unprivileged cBPF programs to influence the processor’s predictions. They then replaced a program with different code in the same memory location.
This sequence caused the processor to briefly follow an outdated prediction into attacker-controlled instructions. Those instructions left measurable cache traces, allowing researchers to reconstruct information one byte at a time.
The team subsequently located a running su process and extracted the root password hash from its memory. Data recovery reached approximately eight bytes per second.
On Intel Raptor Cove, the complete attack took three minutes on average. Meanwhile, tests on Lion Cove averaged five minutes.
Why Replacing Code Can Leave Predictions Behind
Modern processors anticipate which instructions they will need next to improve performance. However, those predictions can outlive the code that originally produced them.
Just-in-time compilation creates machine code while software runs. When a JIT engine removes old code, it may later place new instructions at the same address.
Branch Target Reuse exploits the mismatch between that replacement code and the processor’s earlier branch predictions.
Consequently, the processor can briefly execute instructions from an unintended position before correcting its mistake. Although normal execution does not follow that path, the temporary activity can leave traces in the cache.
Researchers can then measure those traces to infer sensitive data.
Existing Hardening Did Not Stop Both Demonstrations
The researchers developed complete Linux exploits for two configurations: the default setup and one with constant blinding enabled.
Constant blinding makes certain embedded values harder for attackers to control. Nevertheless, the team adapted its technique by placing the required instruction patterns in jump offsets.
That version still recovered the password hash within five minutes.
However, extracting a hash does not guarantee access to the account. Recovering the underlying password depends on factors including password strength and the hashing algorithm.
Browser Findings Have Important Limits
The investigation also covered Mozilla’s SpiderMonkey JavaScript engine and Oracle’s GraalVM. However, neither experiment produced the same complete result as the Linux demonstrations.
In SpiderMonkey, the team confirmed that old predictions could survive code replacement. It did not demonstrate a complete browser exploit.
Meanwhile, GraalVM testing revealed a potential route around a sandbox check during speculative execution. Other engine activity cleared the relevant predictions before researchers could finish the attack.
These findings establish different levels of exposure, rather than equivalent working exploits across all three environments.
Kernel Fixes Address the Reported Issues
The research resulted in identifiers CVE-2026-64507 and CVE-2026-64508, and fixes have entered the Linux kernel.
The team also observed the underlying prediction behavior across every processor it tested, including Intel, AMD, and Arm models. However, the complete Linux password-hash demonstrations described in the research involved Intel processors.
Linux users should install kernel updates containing the fixes. In addition, users should keep operating systems and applicable firmware updates current.
0 responses to “Branch Target Reuse Attack Extracts Linux Root Password Hash in Minutes”