CVE-2026-64507

A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter (BPF) Just-In-Time (JIT) compiler was active, the system did not adequately clear the processor's branch prediction buffer during BPF JIT memory reuse. This could potentially allow an attacker to bypass existing Spectre-v2 protections, leading to the unauthorized disclosure of information.

A Moderate severity flaw was found in the Linux kernel as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When Spectre v2 mitigations are enabled and the Berkeley Packet Filter just-in-time (BPF JIT) compiler is in use, the kernel did not issue an IBPB (Indirect Branch Prediction Barrier) flush when BPF JIT memory was reused, leaving an incomplete defense against JIT spraying. A local attacker with high privileges who is able to load BPF programs could exploit this to bypass Spectre v2 protections and infer sensitive information through the processor's branch prediction behavior. Red Hat scored this flaw CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) because exploitation requires local access and elevated privileges. The kernel and kernel-rt packages are affected across Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams, and fixes are being pursued in the affected product streams. On the RHEL 7 and RHEL 8 update streams, the standard (non-realtime) kernel was assessed as not affected because the vulnerable code is not present in those kernels, while the corresponding kernel-rt realtime kernels are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.