Affected Systems

JIT engines in Mozilla Firefox (SpiderMonkey), GraalVM, and Linux kernel cBPF JIT across Intel, AMD, and other CPU vendors. Affects systems with speculative execution despite existing Spectre-v2 mitigations.

Exploitation Status

Proof-of-concept exploits demonstrated against Linux kernel on fully patched Intel systems. Academic research with working exploits that leak root password hashes within minutes. No evidence of active in-the-wild exploitation.

Business Impact

Attackers with unprivileged code execution in JIT environments can leak sensitive kernel memory, including credentials, bypassing existing Spectre defenses. Linux kernel patches available (CVE-2026-64507, CVE-2026-64508). GraalVM mitigated via code-cache randomization. Mozilla Firefox mitigation pending, prioritizing site isolation deployment instead of immediate IBPB-based fixes.

Urgency

🟡 Within a week

Recommended Actions

  • Apply Linux kernel patches addressing CVE-2026-64507 and CVE-2026-64508 immediately on systems running JIT workloads or untrusted code
  • Update GraalVM to versions incorporating JIT code-cache location randomization
  • Monitor Mozilla security advisories for Firefox site isolation deployment timeline and interim mitigations
  • Audit systems running JIT engines (browsers, language runtimes, eBPF) for exposure to untrusted code execution
  • Consider disabling JIT compilation in high-security environments where performance trade-offs are acceptable until vendor patches are deployed