Executive brief
A vulnerability in the Linux kernel's x86 architecture handling could allow attackers to bypass security protections designed to prevent speculative execution attacks like Spectre. The kernel failed to properly clear internal processor buffers when reusing memory for Just-In-Time (JIT) compiled code. This could potentially allow a malicious user or program to leak sensitive information from other processes or the kernel itself.
Technical details
A vulnerability was identified in the Linux kernel's x86 bug mitigation logic where an IBPB (Indirect Branch Prediction Barrier) flush was not performed during BPF JIT memory allocation/reuse. This omission occurs when Spectre-v2 mitigations are active but the BPF dispatcher is not using a retpoline sequence. Without the IBPB flush, branch prediction state from previously executed JIT code could persist, enabling 'JIT spraying' or other speculative execution side-channel attacks. The fix ensures that an IBPB flush is issued on BPF JIT memory reuse when the CPU supports it and retpoline is not already neutralizing the threat. This affects systems where CONFIG_BPF_JIT is enabled.
Affected products
- Linux Linux Kernel 6.6.145, 6.12.97, 6.18.39, 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df
- https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1
- https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37
- https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d
- https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35