Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026072554-CVE-2026-64508-fe26@gregkh/T
Additional information: The BTR (Branch Target Reuse) research and Linux cBPF end-to-end exploit have now been publicly released: https://github.com/vusec/btr oss-security disclosure: https://www.openwall.com/lists/oss-security/2026/09/30/1 The public repository includes an end-to-end exploit against the Linux cBPF JIT. The published research demonstrates recovery of the root password hash from privileged memory within minutes on an Intel Linux system. This demonstrates a practical information-disclosure attack against sensitive privileged data. CVE-2026-64508 addresses the BPF JIT allocator side of the problem by flushing indirect branch prediction state before JIT memory is reused, preventing newly generated code from inheriting stale branch predictions associated with code that previously occupied the same memory. Relevant stable kernel fixes include: RHEL 7 - RHEL 9 relevant stable commit: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6e52c240c43a601b681e3a4e58fc5685114d4726 RHEL 10 relevant stable commit: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=eed774da601268dae674e14d54a15e3624691f52 Red Hat CVE page: https://access.redhat.com/security/cve/cve-2026-64508 Given the publication of a practical Linux cBPF end-to-end exploit and demonstrated disclosure of the root password hash, could Red Hat please re-evaluate the current impact and remediation priority for this CVE? Could Red Hat also confirm: - whether affected RHEL 7, 8, 9, and 10 kernels have been tested against the public BTR exploit; - whether the above fixes, or equivalent Red Hat backports, are present or planned for each affected RHEL kernel branch; - whether additional mitigations are required in combination with CVE-2026-64507; - whether the demonstrated privileged-memory disclosure primitive could be used as part of a local privilege escalation chain. Although the currently published exploit demonstrates information disclosure rather than a complete LPE, recovering privileged secrets such as the root password hash substantially increases the practical security impact and may provide a useful primitive for chained attacks.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:81406 https://access.redhat.com/errata/RHSA-2026:81406
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:81552 https://access.redhat.com/errata/RHSA-2026:81552