New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks
Source SecurityWeek
Rated by Threat Radar
Data as of 29 Sep 2026, 17:01 UTC
What to do
AI-suggested
Mitigations require software updates implementing indirect branch prediction barriers (IBPB) and related controls. Linux kernel developers have introduced an x86 mitigation triggering IBPB when reusing memory regions for BPF code. Oracle has deployed partial mitigations, and Mozilla is prioritizing site isolation to reduce browser exposure. Existing hardware protections (Intel IBT, Arm BTI) increase difficulty but do not fully prevent exploitation. Users and administrators should apply all available OS and runtime updates addressing this issue. Patch status is not yet fully confirmed; check vendor advisories for current guidance.
Description
Branch Target Reuse (BTR) is a newly disclosed variant of the Spectre v2 attack affecting Intel, AMD, and Arm CPUs. It targets just-in-time (JIT) compilers used in operating system kernels, web browsers, and language runtimes. The attack exploits stale indirect branch prediction entries that persist after code modifications, enabling speculative execution attacks that can leak sensitive data such as password hashes. Researchers demonstrated exploits against the Linux kernel and browser engines like Firefox's SpiderMonkey. Mitigations require software updates, including use of indirect branch prediction barriers (IBPB). Hardware protections reduce but do not eliminate the risk. Vendors acknowledge the issue and have started rolling out mitigations, but no complete fix exists in hardware yet.