New BTR Attack Variant Leaks Linux Root Password Hashes

Researchers have identified a new speculative execution vulnerability, known as Branch Target Reuse (BTR), that can recover Linux root password hashes from modern processors in minutes.

The attack, a variant of the Spectre-v2 vulnerability, was developed by researchers at VUsec (the Systems and Network Security Group at VU Amsterdam) and Scuola Superiore Sant’Anna. Testing demonstrated that the exploit could extract password hashes from Intel, AMD, and Arm-based systems in an average of three to five minutes.

Exploiting JIT Engine Memory Reuse

BTR functions by exploiting the desynchronisation between Just-In-Time (JIT) compiled code and a processor’s branch predictor. When a JIT engine frees code and allocates new code at the same memory address, the CPU may still hold a “stale” prediction of an indirect branch target from the previous code.

By manipulating this leftover information, an attacker can trick the processor into temporarily executing unintended instructions during speculative execution. This process generates a measurable cache trace, allowing the attacker to infer sensitive data byte by byte.

Practicality Against Linux Kernels

In practical tests against the Linux kernel’s classic Berkeley Packet Filter (cBPF), researchers successfully located a running ‘su’ process and recovered the root password hash at a rate of eight bytes per second. The attack remained effective even when constant blinding hardening was enabled.

While leaking a password hash is not the same as retrieving a plaintext password, the researchers noted that an attacker can attempt to crack the hash offline using cloud computing resources. The success of such an attempt depends on the strength of the password and the hashing algorithm used.

The researchers also evaluated the vulnerability against the Firefox SpiderMonkey JavaScript engine and Oracle’s GraalVM. While the BTR mechanism was confirmed in these environments, they noted that complete browser exploitation or full sandbox escapes proved more complex in their specific experiments.

Mitigation and Patching

The discovered vulnerabilities have been assigned the identifiers CVE-2026-64507 and CVE-2026-64508. Fixes for these flaws have already been merged into the Linux kernel.

Linux users are advised to upgrade to the latest kernel version. Additionally, all users should apply the latest operating system and firmware updates to protect against these speculative execution attacks.