In the Fedora release Linux 45, scheduled for fall 2026, plans to enable shadow stack support by default on x86_64 systems to block exploits that overwrite the return address of functions in the event of a stack buffer overflow. This protection is intended to be enabled for all applications and libraries built using the gcc (C, C++), clang (C, C++), and rustc (Rust) compilers. The plan has not yet been approved by FESCo (Fedora Engineering Steering Committee), which is responsible for the technical development of Fedora. LinuxThe initiator of including the shadow stack in Fedora was Arjun Shankar of Red Hat, who maintains the glibc packages in Fedora and RHEL.
The protection is implemented using processor hardware capabilities and consists of storing return addresses not only on the regular stack but also on a separate "shadow" stack after control is transferred to a function, which cannot be modified directly. Before exiting the function, the return address is retrieved from the shadow stack and compared with the return address on the main stack. A mismatch in the addresses generates an exception, preventing situations where an exploit has managed to overwrite an address on the main stack. The shadow stack mechanism is supported starting with 11th-generation Intel processors (Tiger Lake and Rocket Lake) and the Zen3 microarchitecture in AMD processors.
Source: opennet.ru
