New Spectre v2 attack variant leaks Linux root password hash in minutes

The Branch Target Reuse (BTR) attack exploits a fundamental design characteristic of Intel CPUs — speculative execution via branch predictors — to leak sensitive kernel memory, including root password hashes, in minutes. The root cause lies in the processor's inability to safely isolate stale branch predictor state after memory is reused by JIT engines like cBPF, allowing attackers to redirect speculative execution to attacker-controlled code paths. This matters because no software bug needs to be present in the application layer; the vulnerability exists at the hardware/microarchitecture level, making mitigation complex and performance-impactful. Organizations relying on Linux systems with Intel CPUs face a serious privilege escalation and credential theft risk, particularly in shared or multi-tenant environments such as cloud infrastructure.