Linux user-space for several years had shadow stack support for hardware-enforced control-flow enforcement in defending against return oriented programming (ROP) attacks. Intel Tigerlake and newer CPUs or AMD Zen 3 and newer have the necessary hardware shadow stacks support. Shadow stacks have been effective for helping user-space software fend ROP attacks while now there is new work toward bringing shadow stack support for kernel space on Linux.
Intel engineer Dave Hansen sent out the patch series on Wednesday as a request for comments (RFC) to introduce x86 Kernel Shadow Stacks:
"Shadow stacks are a processor security feature that provides a parallel, separate, protected stack for storing return addresses (mostly). There is currently support for them when running userspace, but not running the kernel.Shadow stacks are a very powerful control flow protection mechanism. They represent probably the single most important kernel mitigation in silicon that Linux is not using.
This series is a proof-of-concept to run the kernel with shadow stacks. Some of it will hopefully be mergeable in its current form. Other parts are pure junk and will need to be completely redone. Note the lack of SoB lines.
The point of the series and of this post is to start the conversation about what an initial merge might look like. What are the showstoppers? Let's say eBPF was not supported, or you could only use kernel shadow stacks if mitigation=off. Would that be mergeable?"
The kernel shadow stack code is out for discussion on the LKML.
With the kernel shadow stacks support, the current RFC code also imposes Flexible Return Event Delivery (FRED) as a requirement. This will limit the kernel shadow stacks support to Intel Panther Lake CPUs and newer or AMD Zen 6 and beyond. In any event, promising with the Intel engineer arguing for this security feature as "probably the single most important kernel mitigation in silicon that Linux is not using."
The other big glare is that a number of Linux features that are incompatible with kernel shadow stacks. Among those features currently not compatible with kernel shadow stacks are CPU mitigations like Retpolines, function graph tracing, BPF trampolines, Kexec, EFI mixed mode, KVM, Xen PV, and others. For at least that patch not for merging that outlines all of the initial limitations, it's "a 100% vibe-coded pile of goo."
Testing of the initial Linux kernel shadow stacks support has been done so far on Intel Panther Lake.