CVE-2026-64508
Received Received - Intake

BPF JIT Indirect Branch Predictor Flush in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64508
EUVD
EUVD-2026-48852

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the Linux kernel's BPF JIT allocator where indirect branch predictors from old programs could be reused when new programs are loaded into the same memory space. This could potentially allow an attacker to exploit branch prediction to execute malicious code more easily.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF JIT implementation and does not have direct network detection methods. Detection involves checking kernel version and BPF JIT status. Use 'uname -r' to check kernel version and 'sysctl kernel.bpf_jit_enable' to verify if BPF JIT is enabled. If enabled, monitor for indirect branch predictor reuse issues in JIT memory.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass security mechanisms by leveraging stale branch predictions, potentially leading to arbitrary code execution or privilege escalation on affected systems.

Mitigation Strategies

Update to a patched Linux kernel version that includes the fix for CVE-2026-64508. Disable BPF JIT if not required by setting 'sysctl kernel.bpf_jit_enable=0'. Monitor kernel logs for warnings about BPF JIT memory reuse assumptions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart