Linux Security Summit North America 2026

Intel Control-Flow Enforcement Technology (CET) represents a milestone in hardware-assisted exploit mitigation, providing silicon-level defenses against Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP). This session provides a deep-dive analysis of the two pillars of CET—Indirect Branch Tracking (IBT) and Shadow Stacks (SHSTK)—and their integration into the Linux kernel.

We trace the implementation journey from the initial merge of IBT in Linux 5.18 to the arrival of userspace Shadow Stacks in Linux 6.6. The session explores the microarchitectural mechanics of the #CP (Control Protection) fault and how the kernel manages shadow stack allocations, signal frame tokens, and context switching.

Key topics include:

Forward-Edge Integrity: How IBT uses the ENDBR opcode to restrict indirect branch targets.

Backward-Edge Defense: A deep look at hardware-enforced Shadow Stacks and the management of the Shadow Stack Pointer (SSP).

The Kernel Interface: Leveraging arch_prctl(2) for application opt-in and the role of GLIBC_TUNABLES in production environments.

Edge Cases: Handling complex control flows like setjmp/longjmp, JIT engines, and signal restorers.