security_identifier

CVE-2026-64508

Companion to CVE-2026-64507; the second identifier in the Branch Target Reuse disclosure, which concerns stale indirect branch predictions after code memory is recycled.

Current clusters

security1 publisher

Linux, GraalVM and Mozilla take three different routes against Branch Target Reuse

Linux has merged two kernel fixes, CVE-2026-64507 and CVE-2026-64508, for the Branch Target Reuse Spectre-v2 variant that leaks memory through JIT engines. GraalVM and Firefox took other routes, so a host's coverage depends on which JIT engine it lets untrusted code run in.

Publishers:thehackernews.com

Reality

Evidence58
Adoption40
Hype gap+15
Incentives: Insufficient
Confidence55

security1 publisher

BTR reads a Linux root password hash off an Intel core in minutes

VUsec and Sant'Anna researchers built BTR, a Spectre v2 variant that read a Linux root password hash off two Intel cores in three to five minutes. The Linux kernel fix is merged, and the researchers advise applying operating system and firmware updates.

Publishers:bleepingcomputer.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+15
Incentives: Insufficient
Confidence50