The Linux kernel's BPF JIT allocator packs multiple small programs into larger executable memory allocations and reuses space as programs are loaded and freed. Without flushing indirect branch predictors, indirect jumps into newly written programs could reuse branch prediction data from previously resident code, enabling a form of JIT spraying attack. The vulnerability is mitigated by introducing a static key and call to flush branch predictors on JIT memory reuse. Architectures requiring this flush can implement it, while others default to a no-operation. Allocations larger than a pack are not flushed, which is considered safe due to bounded sizes of unprivileged cBPF programs. A warning is issued if assumptions about program sizes are violated when the flush is active.

This vulnerability could allow an attacker to exploit branch prediction reuse in the BPF JIT allocator, potentially facilitating JIT spraying attacks. Such attacks might undermine kernel security by enabling code reuse or bypassing certain mitigations. However, the fix has been implemented in the Linux kernel to flush branch predictors on JIT memory reuse, reducing the risk. There are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel that flushes indirect branch predictors before reusing JIT memory, preventing reuse of stale branch predictions. This fix is architecture-dependent and applies to allocations within certain size bounds. Users should update to a Linux kernel version that includes this patch to ensure protection. Patch status is not explicitly stated in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.