Linux kernel x86: no IBPB flush on BPF JIT memory reuse while Spectre-v2 mitigations are in use

Impact

This is the x86 half of the JIT-spraying hardening described in CVE-2026-64508: it issues an IBPB on BPF JIT memory reuse when Spectre-v2 mitigations are active, and skips the flush when the BPF dispatcher already uses a retpoline sequence. Without it, the generic flush hook exists but nothing on x86 drives it, so branch predictions left by a freed BPF program can still be consumed by whatever code lands in the same JIT slot. That matters on a shared GPU node where multiple tenants' containers can each load BPF programs onto the same host kernel. Expect a small cost on hosts that JIT BPF heavily, since IBPB is not free. The record describes hardening, with no demonstrated exploit.

Who can reach it

Local, x86 hosts only. Any tenant that can execute code on the node and cause BPF programs to be loaded and freed. No elevated privileges required for the classic-BPF path.

What to do

Update to a stable kernel carrying the listed commits and reboot the node; the enablement is compiled under CONFIG_BPF_JIT and applies at boot, so a running kernel cannot pick it up. Pair it with CVE-2026-64508 - neither is complete alone. Drain GPU workloads before the reboot; there is no mitigation-only path other than reducing who can load BPF on the node.

References