CVE-2026-64507 Details

A vulnerability in the Linux kernel's handling of Just-In-Time (JIT) compilation for Berkeley Packet Filter (BPF) programs has been addressed. This issue, present in the stable branch of the Linux kernel, involves the need for an Inter-Branch Predictability Barrier (IBPB) flush on BPF JIT memory reuse to prevent JIT spraying attacks, especially when mitigations for Spectre variant 2 are active. The vulnerability arises because, without the IBPB flush, there is a risk of indirect branch prediction being exploited, which can lead to data leaks or other malicious activities. The hardening measure is only applied when BPF JIT is enabled, and the IBPB flush is skipped if the BPF dispatcher is already using a retpoline sequence, which is a standard mitigation for Spectre vulnerabilities.

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available in the Linux kernel repository.