# Intel engineer proposes x86 Kernel Shadow Stacks for Linux

> **Key takeaway:** New work aims to bring hardware-enforced shadow stack protection to the Linux kernel to defend against Return Oriented Programming (ROP) attacks.

**Published:** 2026-10-22T13:22:56+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/intel-engineer-proposes-x86-kernel-shadow-stacks-for-linux.html 

## Summary
Intel engineer Dave Hansen has submitted a Request for Comments (RFC) patch series to introduce x86 Kernel Shadow Stacks to the Linux kernel. While user-space has supported this hardware-enforced control-flow protection for years, the kernel currently lacks it. The implementation requires Flexible Return Event Delivery (FRED) support, limiting it to Intel Panther Lake or newer and AMD Zen 6 or newer CPUs.

## Technical requirements and limitations
- Provides a parallel, protected stack specifically for storing return addresses to prevent ROP attacks.
- Requires **Flexible Return Event Delivery (FRED)** hardware support.
- Hardware compatibility: **Intel Panther Lake** and newer, or **AMD Zen 6** and beyond.
- Current incompatible features include: **Retpolines**, **function graph tracing**, **BPF trampolines**, **Kexec**, **EFI mixed mode**, **KVM**, and **Xen PV**.

## Why it matters
If merged, this would provide one of the most significant silicon-based kernel mitigations available, significantly hardening the Linux kernel against control-flow hijacking.