CVE-2026-64507

Executive Summary

CVE-2026-64507 is a hardening defect in the Linux kernel's x86 Spectre-v2 mitigation path, specifically the absence of an IBPB (Indirect Branch Prediction Barrier) flush when BPF JIT memory is reused. Systems running BPF-JIT (CONFIG_BPF_JIT) with Spectre-v2 mitigations enabled — but without a retpoline-sequence BPF dispatcher — are left exposed to JIT-spraying-assisted side-channel attacks. The impact is local information disclosure through speculative execution, not remote code execution, and the patch is confirmed across three independent sources.

Technical Analysis

The vulnerability resides in the x86 bug-mitigation logic — the code path referred to in the CNA title as bugs.c — which is responsible for configuring CPU-level Spectre-v2 defenses at runtime. When the kernel compiles BPF programs through the JIT (CONFIG_BPF_JIT=y), executable memory pages are allocated and reused. Without an IBPB flush on that reuse, stale branch-predictor state from one BPF JIT region can persist and be influenced by, or leak into, another. This is the classic JIT-spraying threat model: an attacker who can influence JIT-generated code layout and then trigger speculative execution can abuse residual predictor state to leak data across privilege or process boundaries when Spectre-v2 mitigations are supposedly active.

The fix enables an IBPB flush specifically on BPF JIT memory reuse, but deliberately skips that flush when the BPF dispatcher already uses a retpoline sequence — since a retpoline dispatcher removes the indirect-branch speculation primitive the flush would otherwise harden. The change is guarded under CONFIG_BPF_JIT so the mitigation source still compiles cleanly when BPF-JIT is disabled. Insecure-default class behavior (CWE-1188): a security-relevant control expected under Spectre-v2 hardening was absent by default for the BPF JIT allocation path.

The attack surface is local and requires an environment where (a) BPF-JIT is active, (b) Spectre-v2 mitigations are enabled, and (c) the BPF dispatcher is not already retpoline-protected. Concretely, unprivileged BPF may be disabled by default on many distributions (kernel.unprivileged_bpf_disabled), which raises the privilege prerequisite — but any actor able to load or influence BPF programs, including a container tenant with BPF capabilities, is in scope.

Exploitation Scenarios

No public PoC or exploit tooling is available, and there is no evidence of in-the-wild exploitation; the attack chain below is inferred from the vulnerability class (speculative-execution JIT spraying) and the mechanics described in the CNA/NVD text.

1. Reconnaissance / target identification: The attacker localizes a Linux host where BPF-JIT is compiled in and active and where Spectre-v2 mitigations are in play (e.g., by reading /proc/cpuinfo mitigation status and kernel configuration exposure, or by observing that the BPF dispatcher is not retpoline-based). This provides no direct indicator but narrows the population of exploitable targets.

2. Triggering the flaw class: Because BPF JIT memory is reused without an IBPB flush, an attacker able to cause BPF programs to be JIT-compiled and then re-execute over reused executable pages can arrange for their own JIT-generated code to sit at a previously-used virtual address. The absence of the barrier means the indirect branch predictor retains entries from the prior occupant of that memory.

3. Side-channel extraction: Using a Spectre-v2 style gadget reachable from the attacker-controlled JIT code, the adversary mistrains the predictor and then issues indirect branches whose speculative targets resolve within the victim's address space, encoding leaked data into a covert channel (e.g., cache timing) that the attacker measures locally. This is a PoC-class mechanism, not a remote network attack.

4. Post-exploitation impact: Successful exploitation yields disclosure of kernel or cross-process memory contents — credentials, keys, or other secrets resident in memory — which can be chained with other bugs or used directly for privilege escalation and lateral movement within a multi-tenant host.

Impact Assessment

The vulnerability is local, requires a non-trivial race/side-channel setup, and yields confidential-data exposure (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, no official score assigned by the vendor). Business impact is elevated for multi-tenant compute (containers, VMs sharing a host), CI runners executing untrusted code with BPF access, and hardened environments that assume Spectre-v2 mitigations are complete. Blast radius is scoped to the local host kernel; there is no remote unauthenticated path described. Severity is moderated by the AC:H and PR:L components and by the fact that many production kernels restrict unprivileged BPF.

Detection Guidance

Sigma Rule

title: Suspicious BPF JIT Loading with Indirect Branch Speculation Patterns
id: 8f2c1d64-9a4e-4b77-b3e1-0c5a7d2f9e10
status: experimental
description: Detects repeated BPF program loading and JIT activity that may indicate JIT-spraying attempts against CVE-2026-64507.
logsource:
  product: linux
  service: auditd
detection:
  selection_bpf:
    type: 'BPF'
  selection_syscall:
    syscall|contains:
      - 'bpf'
  filter_legit:
    exe|startswith:
      - '/usr/sbin/'
      - '/usr/lib/systemd/'
  condition: selection_bpf or selection_syscall and not filter_legit
falsepositives:
  - Legitimate observability agents (eBPF-based)
  - Container runtimes loading BPF programs
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068

YARA Rule

rule CVE_2026_64507_BPF_JIT_Spray_Indicator
{
    meta:
        author = "Threat Intelligence"
        description = "Heuristic detection for suspicious BPF JIT spray artifacts in memory dumps"
        cve = "CVE-2026-64507"
        date = "2026-01-01"
    strings:
        $s1 = "BPF_JIT" ascii
        $s2 = "bpf_jit" ascii
        $s3 = "ibpb" ascii nocase
        $s4 = "retpoline" ascii nocase
        $s5 = { 0F 01 F8 }   // IBPB instruction opcode
    condition:
        uint32(0) == 0x464C457F and 2 of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-64507 BPF JIT speculative side-channel recon - low confidence"; flow:to_server,established; content:"bpf"; nocase; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-recon; sid:6450701; rev:1;)

Elastic Detection

process where event.category == "process" and process.name in ("bpf", "bpftool")
and process.args : "*jit*"
and process.args_count > 3
sequence by host.id with maxspan=5m
  [ process where process.name == "bpftool" ]
  [ file where file.path : "/sys/kernel/btf/*" ]

Splunk SPL Query

index=os sourcetype=auditd type=SYSCALL syscall=*bpf*
| stats count values(comm) as processes by host, uid, syscall
| where count > 20
| table host, uid, processes, count

Wazuh OSSEC Rule

<group name="linux,cve-2026-64507">
  <rule id="645070" level="8">
    <decoded_as>auditd</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <match>bpf</match>
    <description>CVE-2026-64507: Suspicious BPF JIT syscall activity detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 4/4 (CONFIRMED — 3+ independent sources: CNA, OSV, Debian confirm the fix).

1. Immediate mitigations: Disable unprivileged BPF where not business-required (kernel.unprivileged_bpf_disabled=1 or 2), reducing the local attack surface. Where supported, prefer a retpoline-based BPF dispatcher, which the patch itself treats as already-mitigated. Review container/runner workloads for unnecessary BPF capabilities.

2. Patch/upgrade steps: Apply the upstream kernel fix titled "x86/bugs: Enable IBPB flush on BPF JIT allocation" from your vendor (Debian, Ubuntu, RHEL, or mainline). Confirm CONFIG_BPF_JIT=y environments receive the change, and that distributions with CONFIG_BPF_JIT=n are unaffected. Track vendor kernel advisories since the fix is confirmed but no stable backport version is listed in the referenced data.

3. Long-term hardening: Enable CPU-enforced mitigations and IBPB on context switch, maintain CPU microcode current, audit BPF usage across tenants, and codify a policy requiring speculative-execution defenses to be verifiable at runtime. Monitor for the presence of the IBPB instruction (0F 01 F8) in relevant kernel paths as confirmation of the hardening.

References

1. NVD — CVE-2026-64507: https://nvd.nist.gov/vuln/detail/CVE-2026-64507
2. OSV Advisory for CVE-2026-64507: https://osv.dev/vulnerability/CVE-2026-64507
3. Debian Security Tracker — CVE-2026-64507: https://security-tracker.debian.org/tracker/CVE-2026-64507
4. Linux Kernel x86 bug-mitigation documentation (Spectre-v2 / IBPB): https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/
5. CISA Known Exploited Vulnerabilities catalog — not listed (no KEV entry; no in-the-wild exploitation reported).