New Spectre v2 attack variant leaks Linux root password hash in minutes
Source Bleeping Computer
Rated by Threat Radar
Data as of 29 Sep 2026, 17:13 UTC
What to do
AI-suggested
Fixes for this vulnerability have already been merged into the Linux kernel. Users are advised to update their Linux systems to the latest kernel versions containing these patches. Additionally, applying relevant OS and firmware updates is recommended. Since this is a hardware-related speculative execution issue, full mitigation requires both software patches and potentially future CPU design changes. No further immediate action is required beyond applying the official fixes.
Description
A new variant of the Spectre v2 speculative execution side-channel attack, called Branch Target Reuse (BTR), has been demonstrated to leak Linux root password hashes on Intel-based systems within minutes. This attack exploits stale branch predictor information when just-in-time (JIT) compiled code is replaced but the CPU still speculatively executes instructions based on old predictions. Researchers confirmed this vulnerability affects modern CPUs from Intel, AMD, and ARM. Fixes have been merged into the Linux kernel to address this issue.