Linux kernel BPF JIT: reused JIT memory can inherit branch predictions from the program that freed it

Impact

The BPF JIT packs many small programs into shared executable allocations and reuses that space as programs are loaded and freed. Before this fix, an indirect jump into freshly written code could resolve against a branch prediction left behind by the program that previously occupied the same address, which is the primitive behind JIT-spraying-style Spectre-v2 attacks. The fix adds a hook (static key plus static call) to flush indirect branch predictors before JIT memory is reused; the x86 side that actually enables it is CVE-2026-64507. On a GPU node packing several tenants' pods, unprivileged classic BPF - seccomp filters and socket filters are reachable from an ordinary container - is the attack surface the commit explicitly names as the unprivileged one. The record describes hardening, not a demonstrated exploit or a leak of specific data.

Who can reach it

Local. Any tenant that can run code on the node and load a BPF program, including unprivileged classic BPF via seccomp or socket filters. No elevated privileges and no network reachability required.

What to do

Update to a stable kernel carrying the listed commits and reboot. This is JIT-allocator plumbing plus a new static call, not the kind of narrow change usually shipped as a livepatch, so plan a drain and reboot per node rather than a hot patch. It has no effect on its own without the architecture enablement (CVE-2026-64507), so take both. If you cannot reboot promptly, disabling unprivileged BPF (kernel.unprivileged_bpf_disabled) narrows the unprivileged surface but does not remove it, since seccomp filters remain available.

References