Branch Target Reuse Spectre Variant Reuses Stale Predictions in cBPF JIT to Leak Root Hashes at 8 Bytes per Second

The attack exploits processors that restore architectural coherence after code changes but leave indirect branch prediction entries intact. In Linux cBPF used by seccomp and packet filters, an unprivileged attacker reuses obsolete targets to create a speculative execute-after-free primitive, bypassing existing Spectre mitigations on modern Intel silicon and leaking arbitrary kernel memory including root password hashes at 8 bytes per second.

Evidence comes from two end-to-end kernel exploits and partial browser POCs. Researchers verified stale entries persist long enough in SpiderMonkey on Intel to enable dozens of bytes per second leakage when site isolation is incomplete. GraalVM showed address reuse but was limited by its own garbage collection erasing entries before exploitation.

This extends the pattern seen in prior Spectre variants where hardware leaves microarchitectural state uncleared across JIT boundaries. CPU vendors correctly note IBPB can block it, yet the fix burden falls on software because every JIT recompilation in shared memory regions now requires explicit barriers. Linux already added an x86 IBPB trigger on cBPF reuse.

Next steps include wider IBPB deployment in other JITs and potential hardware changes in future cores. Unmitigated, the technique affects any runtime allowing untrusted code to trigger JIT writes to previously executed memory pages.