← Thursday, October 1, 2026SecurityPaper

Stale branch predictions enable Spectre-v2 attacks in JIT engines

vusec.net 7 min read Editor score 8/10

Branch Target Reuse exploits stale indirect branch predictions that can survive code-cache repopulation, creating a speculative execute-after-free primitive; the researchers built two Linux kernel exploits. JIT and runtime engineers should consider how generated-code reuse interacts with CPU speculation.

What

Branch Target Reuse (BTR) is a Spectre-v2 attack that targets JIT engines across browsers, language runtimes, and the kernel.

Method

A stale branch-prediction entry can survive code deallocation and be reused when a new code chunk occupies the old address.

Why it matters

JIT code-cache reuse can enable speculative control-flow hijacking, so code-generation and memory-reuse defenses must account for stale CPU prediction state.

Read on vusec.net → Lobsters

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.