TL;DR
Intel engineer Dave Hansen has sent a patch series to the Linux Kernel Mailing List to introduce kernel-level shadow stack support.
Intel engineer Dave Hansen sent a patch series to the Linux Kernel Mailing List on Wednesday to introduce x86 Kernel Shadow Stacks. These mechanisms offer guarded storage spaces for return addresses to defend against return oriented programming attacks. While Linux has supported shadow stacks for user-space for several years, Hansen says the kernel is not currently using this hardware-enforced protection.
The patch series is a proof-of-concept, and Hansen noted that some parts will likely need to be redone. Initial testing was performed on Intel Panther Lake. Implementing this feature currently conflicts with several Linux features, including KVM, Xen PV, Kexec, Retpolines, function graph tracing, BPF trampolines, and EFI mixed mode. Existing hardware support for shadow stacks requires Intel Tiger Lake or newer, or AMD Zen 3 or newer.



