CVE-2026-64508: In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many...

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.

Metrics

EPSS Probability

0.16%

5.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 6e52c240c43a601b681e3a4e58fc5685114d4726; >= 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < eed774da601268dae674e14d54a15e3624691f52; >= 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 8ff183ee4d8c452960df58175a094828c0513b2e; >= 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 7a6c171c6a1ac6d1509752dac131d941a3de0b37; >= 57631054fae6dcc9c892ae6310b58bbb6f6e5048, < 96cce16e26dd02a8678f1e87f88a4b5cdb63b995
Linux	Linux	5.18

References

Timeline

Published: Jul 25, 2026
Last Modified: Jul 27, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-64508?

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.

How severe is CVE-2026-64508?

Severity scoring for CVE-2026-64508 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.

How do I fix CVE-2026-64508?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →