CVE-2026-64508

What the bug is

The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

include/linux/filter.h
kernel/bpf/core.c

What this is

BPF [CORE]MAINTAINERS section matched on include/linux/filter.h · bpf@vger.kernel.org · Maintained

Check it on the machine

grep -w CONFIG_BPF /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this code. Every release below compiles the affected file into the kernels it ships.

• bookworm, trixie, forky, sid, bookworm · linux-6.12y

y

built into the kernel image on every flavour - only a patch removes it

Build switch

CONFIG_BPF

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-07-25 (3 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.19%, higher than 8.0% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

include/linux

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.18	6.1.183	1fbafd5235ca
5.18	6.6.145	6e52c240c43a
5.18	6.12.97	eed774da6012
5.18	6.18.39	8ff183ee4d8c
5.18	7.1.4	7a6c171c6a1a
5.18	7.2	96cce16e26dd

Debian advisories