New Spectre v2 BTR variant leaks Linux root hashes in 3-5 minutes on Intel

Affected Systems

Intel, AMD, and Arm CPUs with indirect branch prediction. Confirmed exploitable on Linux kernel cBPF (default and constant blinding configurations). Firefox SpiderMonkey and Oracle GraalVM also affected but full exploits not demonstrated. CVE-2026-64507 and CVE-2026-64508 assigned. Linux kernel fixes already merged.

Exploitation Status

Proof-of-concept demonstrated by VUsec researchers. End-to-end exploits successfully recover root password hashes from Linux systems in 3-5 minutes on Intel Raptor Cove and Lion Cove architectures. No evidence of active in-the-wild exploitation reported.

Business Impact

Unprivileged local attackers can extract root password hashes from Linux systems via classic BPF programs at 8 bytes/second. Hash recovery enables offline password cracking attempts. Attack exploits fundamental CPU branch predictor behavior across Intel, AMD, and Arm processors—no current hardware mechanism prevents desynchronization between predictor and code state. Requires local access and ability to run BPF programs. Mitigations available via Linux kernel patches.

Urgency

🟠 Within 24 hours

Recommended Actions

• Apply latest Linux kernel updates immediately—fixes for CVE-2026-64507 and CVE-2026-64508 are already merged
• Deploy available CPU microcode/firmware updates from Intel, AMD, and Arm vendors
• Review and restrict unprivileged access to BPF subsystem via kernel.unprivileged_bpf_disabled sysctl setting
• Audit systems for unauthorized local access or privilege escalation attempts in authentication logs
• Enforce strong password policies and consider migrating to password hashing algorithms resistant to offline cracking (e.g., Argon2)