Linux Security Summit North America 2026

As computing systems evolve, memory-safety exploits such as return-oriented programming (ROP) and jump-oriented programming (JOP) remain a serious threat. These attacks manipulate control flow within valid address space, reusing existing code “gadgets” to achieve the attackers desired results. Arm AArch64 provides architectural defenses against these attacks through Pointer Authentication Codes (PAC), Guarded Control Stack (GCS), and Branch Target Identification (BTI).

This talk explains how these technologies work and, more importantly, what Linux developers, distributions, packagers, and toolchains must do to deploy them correctly. We cover the AArch64 Linux ABI implications, including requirements for hand-written assembly, use of BTI and PAC instructions, and PAC key management. We dive into real-world toolchain and language impacts, including changes to C code generation, C++ exception unwinding, DWARF metadata updates, and use of Arm's hint space instructions. Attendees will also learn common pitfalls, debugging challenges, and deployment trade-offs observed in practice.

By the end of this session, participants will understand how to deploy PAC, GCS, and BTI across Linux.