The latest security information on Intel® products.

Announcement ID:

2026-10-01-001 

Issue:

Researchers from VUSec and Scuola Superiore Sant'Anna disclosed a paper titled “Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries.” The paper describes a speculative execution research technique known as Branch Target Reuse (BTR), which reuses stale indirect branch prediction entries in Just-In-Time (JIT) environments to influence transient execution and potentially expose sensitive information under specific conditions. Public demonstrations focused on Linux cBPF and other JIT-enabled runtimes. 

Intel completed its assessment and determined that the reported behavior is addressed by existing Intel guidance for Spectre v2-related attacks, including Branch History Injection (BHI) and Intra-mode Branch Target Injection (IMBTI). Intel does not consider BTR to represent a new Intel hardware vulnerability requiring new Intel-specific mitigations. 

Resolution/Recommendations:

Intel's assessment is that the reported behavior is covered by Intel's existing guidance for branch prediction attacks[1]. Intel recommends customers maintain current operating system updates and follow applicable Intel security guidance. 

Intel has also committed Linux kernel defense-in-depth hardening updates for the BPF JIT, aligned with Intel’s existing guidance, to reduce the risk of specialized attacks against BPF JIT code execution.

Additional Resources:

• Managed Runtime Speculative Execution Side Channel Mitigations

• Branch History Injection and Intra-mode Branch Target Injection

• Linux Kernel defense-in-depth updates

  • https://lore.kernel.org/stable/20260709-cbpf-jit-spray-hardening-7-1-y-v1-1-5ac5a2d6797f@linux.intel.com/ 
  • https://lore.kernel.org/stable/20260709-cbpf-jit-spray-hardening-7-1-y-v1-2-5ac5a2d6797f@linux.intel.com/ 

[1] “Mitigations need to be applied to code executing in the same address space as the secret data: the runtime execution engine (for example, a fast/optimizing JIT or AOT compiler, etc.), the runtime environment itself, and the process hosting the runtime”

Acknowledgements:

Intel thanks Sander Wiebing and Cristiano Giuffrida of Vrije Universiteit Amsterdam; Yuhui Zhu of Scuola Superiore Sant’Anna and Scuola IMT Alti Studi Lucca; and Alessandro Biondi of Scuola Superiore Sant’Anna for their research and coordinated disclosure of Branch Target Reuse (BTR).