CVE-2026-64507 x86/bugs: Enable IBPB flush on BPF JIT allocation

Not scored Published 25 Jul 2026 Updated 19 Aug 2026

Attackers can bypass Spectre-v2 mitigations via BPF JIT memory reuse, requiring local access and specific kernel configurations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64507?

CVE-2026-64507 is a vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Enable IBPB flush on BPF JIT allocation

Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence.

This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.

Which versions are affected by CVE-2026-64507?

How do I fix CVE-2026-64507?

Apply the vendor's patch.

Is CVE-2026-64507 being exploited?

There is no known exploitation of CVE-2026-64507 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as AZL-93809, BELL-CVE-2026-64507, DEBIAN-CVE-2026-64507, GHSA-mfjh-rff8-525v, ROOT-OS-UBUNTU-2204-CVE-2026-64507, UBUNTU-CVE-2026-64507.