VulnSocial

CVE-2026-64508Patch

HIGH

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.

Back to dashboard
7.5/ 10 priority

Sources & remediation

Other references

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 13 mentions across 6 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 9 signals
  • General: 2 classified signals
  • Peaked 3d ago at 6 mentions (2026-09-30); latest day: 1
  • 13 total mentions across 6 days

Deep dive

Activity timeline13 mentions / 6d
02356Mentions · 2026-07-25: 3Mentions · 2026-09-29: 1Mentions · 2026-09-30: 6Mentions · 2026-10-02: 1Mentions · 2026-10-03: 1Mentions · 2026-10-07: 1PoC Mentioned / Linked · 2026-09-30: 2PoC Mentioned / Linked · 2026-10-07: 1Exploit Tool / Code · 2026-09-30: 1Exploit Tool / Code · 2026-10-07: 1Active Exploitation · 2026-09-30: 1Patch / Workaround · 2026-09-29: 1Patch / Workaround · 2026-09-30: 5Patch / Workaround · 2026-10-02: 1Technical Details · 2026-07-25: 1Technical Details · 2026-09-29: 1Technical Details · 2026-09-30: 6Technical Details · 2026-10-07: 107-2509-2909-3010-0210-0310-07
Signal classification6 categories
Patch
646.2%
General
215.4%
PoC
215.4%
Active Exploitation
17.7%
Disclosure
17.7%
False Positive
17.7%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-07-253
General2Patch1
2026-09-291
Patch1
2026-09-306
Active Exploitation1Disclosure1Patch3PoC1
2026-10-021
Patch1
2026-10-031
False Positive1
2026-10-071
PoC1
Full discourse13 posts
  • Es Geeks@EsGeeks
    Patch

    🚨 Nueva variante Spectre v2 (BTR) filtra el hash root de Linux en 3-5 minutos en CPUs Intel. Afecta BPF JIT y más. Parches ya en el kernel. Actualiza ya. CVE-2026-64507 / CVE-2026-64508 #Spectre #Linux #Ciberseguridad https://t.co/f8mc63J8yL

    Post summary

    The tweet discloses a new Spectre v2 variant affecting Linux on Intel CPUs, detailing technical impact like root hash leaks via BPF JIT, and confirms that kernel patches are already available while urging immediate updates.

    1101331.1K
    22.6K followersView on X
  • OSS開発者@hacker_infra
    False Positive

    CVE-2026-64508 and CVE-2026-64507 これ改めてRed hatに確認したら、カーネルパラメーターでBPFの実行を制限しているから、再現するのはむずかしいみたいだね。 cat /proc/sys/kernel/unprivileged_bpf_disabled 世間で大騒ぎするほどでもない。Ubuntu系も同じかな 私の予想通りだったが、念のためベンダー確認をいれておいた https://news.yahoo.co.jp/articles/d8c06abe5cce56e93e9f6b47257d6a05dcb6c60d

    Post summary

    The text mentions CVE-2026-64508 and CVE-2026-64507 but debunks their severity by citing kernel parameters that hinder exploitation, supported by vendor confirmation, and includes a news link without detailing the vulnerabilities.

    03081920
    2.9K followersView on X
  • skeptic 🖖@3kept1c
    Patch

    @elhackernet Hay dos CVE asociados a este nuevo exploit de Spectre: CVE-2026-64507 y CVE-2026-64508. Ambos se corrigieron en el kernel en agosto, con Debian trixie están parcheados desde la 6.12.100-1, acabo de instalar la 6.12.111 ayer.

    Post summary

    The tweet confirms CVE-2026-64507 and CVE-2026-64508 are patched in the Linux kernel since August, with Debian Trixie fixed from kernel 6.12.100-1 onward, and the user installing 6.12.111 yesterday.

    01030187
    516 followersView on X
  • Orion84@Orion84x
    PoC

    Spectre is back, and it is practical. Branch Target Reuse (CVE-2026-64507/CVE-2026-64508) leaked a Linux root password hash in 3-5 minutes on recent Intel CPUs via cBPF. Local only, not remote. Kernel fixes are already merged. Patch shared Linux hosts Link https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes/

    Post summary

    The tweet announces a practical Spectre variant (CVE-2026-64507/64508) that can locally leak root password hashes on recent Intel CPUs via cBPF, notes that kernel fixes and a patch are already available, and references an article that contains a proof‑of‑concept.

    1002074
    22 followersView on X
  • Frontiera Tech@FrontieraTechIT
    Active Exploitation

    🛡️ CYBER BULLETIN | 2026/09/30 🚨 1) NetScaler CVE-2026-88772 now dropping WHIPSHOT Mandiant and GTIG say attackers are using the DTLS overflow for unauthenticated root on ADC/Gateway boxes in North America and Europe. After the crash they install PHP webshells (WHIPSHOT) and the SLAPSHOT Python tunnel to walk internal networks. GreyNoise says mass exploitation kicked in after 28 Sep. 2) OpenSSL patches DTLS heap leak CVE-2026-84782 A High-severity bug can dump unencrypted heap to the peer or crash the process when a DTLS handshake resent overlaps a larger in-flight message. Fixed in 4.0.3, 3.6.5, 3.5.9 and 3.4.8. Hits WebRTC and other UDP TLS paths. No workaround. 3) Apple CoreGraphics zero-day CVE-2026-86950 is in CISA KEV Out-of-bounds write found by Meta Product Security. Apple says it was used in “extremely sophisticated” targeted attacks on iOS before iOS 27. Patches: iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, Sequoia 15.8.1. CISA added it to KEV on 29 Sep. 4) DIVD hit by a sloppy agentic attacker The Dutch Institute for Vulnerability Disclosure says an automated AI agent exploited a non-NetScaler bug, then ran post-exploitation itself — loud, fast, and error-prone (it even collided with its own password-spray AitM). Police, AP and NCSC notified. Full IOCs held back for the investigation. 5) Spectre v2 BTR leaks Linux root hashes VUSec and Scuola Superiore Sant’Anna showed Branch Target Reuse: stale JIT branch-predictor entries survive self-modifying code. PoCs against Linux cBPF JIT recovered the root password hash in minutes on patched Intel boxes. Kernel fixes: CVE-2026-64507 and CVE-2026-64508. Firefox, GraalVM also in scope. #Cybersecurity #CISA #NIST

    Post summary

    The bulletin reports active exploitation of multiple CVEs, including NetScaler DTLS overflow (CVE-2026-88772) delivering WHIPSHOT webshells and SLAPSHOT tunnel, OpenSSL DTLS heap leak patched, Apple CoreGraphics zero-day in CISA KEV, and Spectre v2 BTR PoCs revealing root hashes.

    10010230
    100 followersView on X
  • BT Haberler@BTHaberler
    PoC

    Yeni "BTR" Saldırısı, Tamamen Yamalı Intel Sistemlerden Dakikalar İçinde Root Şifre Karmasını Sızdırabiliyor! Araştırmacılar, JIT (just-in-time) derleyici motorlarını hedef alan yeni bir Spectre v2 varyantı olan "Branch Target Reuse" (BTR) saldırısını duyurdu; CVE-2026-64507 ve CVE-2026-64508 olarak kayıtlı açık, "eski" (stale) dal tahmini kayıtlarının kod önbelleği yeniden doldurulduğunda tekrar kullanılabilmesinden yararlanarak SpiderMonkey (Firefox), GraalVM ve Linux çekirdeğinin cBPF JIT'i gibi sistemlerden bellek sızdırıyor. • Araştırmacılar, tamamen güncel ve yamalı Intel sistemlerden dakikalar içinde root parola karmasını (hash) sızdırabilen çalışan bir kanıt niteliğinde istismar kodu (PoC) geliştirdiler; saldırı mevcut Spectre v2 savunmalarını atlatıyor. • Sorun, modern CPU'ların kod değiştirildiğinde tüm mikromimari durumu senkronize etmemesinden kaynaklanıyor; bu da "zamansal" (temporal) boyutta yeni bir Spectre saldırı sınıfı ortaya koyuyor. Yıllardır üzerinde çalışılan Spectre savunmalarının bile, donanımın "eski" tahmin verilerini temizlemeyi unuttuğu bir zaman boşluğuyla atlatılabilmesi, işlemci seviyesindeki yan kanal risklerinin yazılım yamalarıyla asla tam olarak kapatılamayabileceğini gösteriyor. #SiberGüvenlik #Spectre #CPU

    Post summary

    The text discloses a new Spectre v2 variant (BTR) and reports that researchers developed working PoC exploit code targeting JIT compilers, though no active exploitation or specific patch remediation is detailed.

    0001071
    44 followersView on X
  • Diario฿itcoin@DiarioBitcoin
    Disclosure

    ⚠️ Nueva variante de Spectre puede filtrar el hash de root Branch Target Reuse explota código JIT y objetivos obsoletos del predictor de saltos. Investigadores reportaron hasta 5,7 KB/s en pruebas con Linux e Intel. Linux y Oracle aplicaron mitigaciones. CVE-2026-64507 y CVE-2026-64508.

    Post summary

    The tweet announces a new Spectre‑style vulnerability (CVE-2026-64507/64508) that leverages Branch Target Reuse on Linux and Oracle, notes mitigations applied, and provides technical details, but offers no PoC, exploit tool, active exploitation evidence, or a specific patch.

    10000521
    213.4K followersView on X
  • DFIR Radar@DFIR_Radar
    Patch

    BTR, a new Spectre-v2 variant, exploits stale branch prediction entries in JIT engines across Linux cBPF, GraalVM, and Firefox's SpiderMonkey. Patch Linux for CVE-2026-64507 and CVE-2026-64508. #DFIR_Radar https://t.co/ZwHUyaHnyf

    Post summary

    The tweet discloses a new Spectre-v2 variant (BTR) affecting JIT engines in Linux cBPF, GraalVM, and Firefox SpiderMonkey, and explicitly instructs users to patch Linux for CVE-2026-64507 and CVE-2026-64508.

    10000189
    2.0K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-64508 In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs … https://www.cve.org/CVERecord?id=CVE-2026-64508

    Post summary

    The advisory confirms that CVE-2026-64508, a Linux kernel BPF JIT spraying vulnerability, has been fixed, providing brief technical context but no exploitation details.

    000011.5K
    57.9K followersView on X
  • Badger Signal@BadgerSignalHQ
    Patch

    🔬 New Spectre-v2 Variant (BTR) Leverages JIT Engines to Leak Linux Memory Security researchers have disclosed Branch Target Reuse (BTR)—a new Spectre-v2 vulnerability (CVE-2026-64507 & CVE-2026-64508) that demonstrates speculative execution side-channel attacks are far from solved. Here is what infrastructure, kernel, and threat intel teams need to keep on their radar: 🔹 The Mechanism: BTR exploits a fundamental gap in modern CPUs (Intel, AMD, Arm). When Just-In-Time (JIT) engines allocate, free, and reuse memory regions, the CPU’s Branch Target Buffer (BTB) retains stale indirect branch prediction entries. 🔹 The Attack Vector: An unprivileged attacker can manipulate this stale data to create a "speculative execute-after-free" primitive, bypassing existing hardware and software mitigations (including FineIBT and constant blinding). 🔹 Real-World Impact: Researchers demonstrated end-to-end exploits against the Linux kernel's cBPF JIT, successfully leaking root password hashes from memory in minutes. Runtime engines like Firefox’s SpiderMonkey and Oracle’s GraalVM are also affected. Mitigation Steps: Update Linux kernels immediately to apply merged patches addressing CVE-2026-64507 / CVE-2026-64508. Ensure browser and runtime environments are patched as vendor updates roll out. Read our complete technical breakdown at Badger Signal: 👇 https://badgersignal.com/articles/new-spectrev2-variant-branch-target-reuse-btr-exploits-jit-engines-and-linux-kernel #Cybersecurity #Linux #HardwareSecurity #VulnerabilityManagement #ThreatIntelligence #InfoSec #Spectre #AppSec

    Post summary

    The tweet discloses a new Spectre‑v2 variant (CVE‑2026‑64507/64508) that leverages JIT engines to leak Linux kernel memory via stale BTB entries and bypass existing mitigations. It also explicitly urges updating Linux kernels and patched browsers/runtime to mitigate the vulnerability.

    0000061
    8 followersView on X
  • Cybersecurity News Everyday@TweetThreatNews
    Patch

    New Spectre v2 variant BTR can leak Linux root password hashes in minutes by abusing stale branch predictor state. Impacts cBPF, Firefox SpiderMonkey, and GraalVM; kernel fixes are merged for CVE-2026-64507 and CVE-2026-64508. #Linux #Spectre #VUSec https://www.hendryadrian.com/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes/

    Post summary

    A newly discovered Spectre v2 (BTR) variant can exfiltrate Linux root password hashes in minutes by exploiting stale branch prediction, affecting cBPF, Firefox SpiderMonkey, and GraalVM; kernel fixes for the related CVEs have already been merged.

    00000237
    4.9K followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-64508 In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs … https://www.cve.org/CVERecord?id=CVE-2026-64508 ----- Traducción: CVE-2026-64508 En … http://infoflow.cloud`

    Post summary

    The post announces that CVE‑2026‑64508, a BPF JIT spraying issue in the Linux kernel, has been resolved, but gives no details on exploitation, PoC, or fixes.

    0000023
    95 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-64508 In the Linux kernel, the following vulnerability has been resolved: bpf https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64508

    Post summary

    The brief notice indicates that CVE‑2026‑64508 was resolved in the Linux kernel’s BPF subsystem, but offers no additional technical, exploit, or patch details.

    00000102
    4.1K followersView on X

Explore more

Back to dashboard