Skip to main content
CVE-2026-64507VulnerabilityPublished 07/25/2026

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation…

Source GCVE Database

0

Not known to be exploited.

Data as of 10/24/2026, 22:16:04 UTC

Severity
Medium

No CVSS score from NVD or the CNA

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

What to do

AI-suggested

A fix has been implemented in the Linux kernel to enable IBPB flush on BPF JIT allocation when Spectre-v2 mitigations are active. Users should ensure their kernel is updated to a version including this fix. The mitigation is effective only if BPF JIT is enabled (CONFIG_BPF_JIT). No additional action is required beyond applying the official kernel update containing this patch.

Description

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.

Impact

This vulnerability could potentially allow attackers to bypass Spectre-v2 mitigations through JIT spraying techniques when BPF JIT is in use. The fix reduces this risk by ensuring an IBPB flush occurs on BPF JIT memory reuse, thereby improving kernel security against speculative execution attacks related to JIT spraying.

References

Community reviews

Loading reviews…