The Linux kernel addressed a vulnerability (CVE-2026-64507) involving the x86 architecture's handling of BPF JIT allocations. The fix enables an Indirect Branch Prediction Barrier (IBPB) flush on reuse of BPF JIT memory to strengthen defenses against JIT spraying attacks under Spectre-v2 mitigations. The IBPB flush is skipped if the BPF dispatcher already uses a retpoline sequence. This hardening is conditional on the BPF JIT feature being enabled via CONFIG_BPF_JIT.

This vulnerability could potentially allow attackers to bypass Spectre-v2 mitigations through JIT spraying techniques when BPF JIT is in use. The fix reduces this risk by ensuring an IBPB flush occurs on BPF JIT memory reuse, thereby improving kernel security against speculative execution attacks related to JIT spraying.

A fix has been implemented in the Linux kernel to enable IBPB flush on BPF JIT allocation when Spectre-v2 mitigations are active. Users should ensure their kernel is updated to a version including this fix. The mitigation is effective only if BPF JIT is enabled (CONFIG_BPF_JIT). No additional action is required beyond applying the official kernel update containing this patch.