Spectre-v2 BTR Reuses Stale BTB Entries to Leak Linux cBPF JIT Memory on Patched Intel

The Branch Target Reuse variant exploits the fact that CPUs do not flush BTB entries when JIT engines free and reuse code-cache pages. An attacker trains an indirect branch to a now-freed chunk, forces reallocation at overlapping addresses, then triggers the stale prediction to execute architecturally invalid entry points that bypass existing Spectre-v2 mitigations such as eIBRS and fine-grained IBPB.

Proof-of-concept runs against SpiderMonkey, GraalVM, and the kernel cBPF JIT showed leakage rates sufficient to extract 64-bit secrets within minutes on default configurations. The attack requires only unprivileged JIT execution and does not rely on new hardware flaws, only on the persistence of BTB state across SMC operations that current software hardening assumes are safe.

Existing vendor guidance and kernel mitigations were written before the interplay between JIT code-cache reuse and indirect-branch prediction was measured at scale. Procurement records from Intel and AMD show continued investment in prediction-buffer partitioning, yet no public contract specifies invalidation semantics for dynamically generated code.

Kernel maintainers are expected to introduce BTB invalidation hooks around cBPF allocation sites; browser vendors will likely follow with similar changes to their JIT allocators within the next two release cycles.