CVE-2026-64507
Description
A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter (BPF) Just-In-Time (JIT) compiler was active, the system did not adequately clear the processor's branch prediction buffer during BPF JIT memory reuse. This could potentially allow an attacker to bypass existing Spectre-v2 protections, leading to the unauthorized disclosure of information.
Statement
A Moderate severity flaw was found in the Linux kernel as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When Spectre v2 mitigations are enabled and the Berkeley Packet Filter just-in-time (BPF JIT) compiler is in use, the kernel did not issue an IBPB (Indirect Branch Prediction Barrier) flush when BPF JIT memory was reused, leaving an incomplete defense against JIT spraying. A local attacker with high privileges who is able to load BPF programs could exploit this to bypass Spectre v2 protections and infer sensitive information through the processor's branch prediction behavior. Red Hat scored this flaw CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) because exploitation requires local access and elevated privileges. The kernel and kernel-rt packages are affected across Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams, and fixes are being pursued in the affected product streams. On the RHEL 7 and RHEL 8 update streams, the standard (non-realtime) kernel was assessed as not affected because the vulnerable code is not present in those kernels, while the corresponding kernel-rt realtime kernels are affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
