Linux v5.10 introduces major security hardening and architectural changes

The Linux v5.10 release introduced several security-focused updates, including register state encryption for AMD SEV-ES and static calls for x86 to mitigate Spectre-related overhead. The kernel also saw the removal of set_fs() for x86, RISC-V, and PowerPC architectures, and the introduction of a nosymfollow mount option to prevent symlink-based attacks.

Key security enhancements in v5.10

• AMD SEV-ES: Adds register state encryption to prevent VM hosts from reconstructing guest VM states.
• x86 Static Calls: Replaces indirect function calls with direct calls, eliminating the need for RETPOLINE mitigations and improving performance in hot-paths.
• Network RNG: Replaces the internal pRNG with the SipHash round function to prevent brute-forcing of network sequence numbers.
• Architecture Cleanup: Completely removes set_fs() for x86, RISC-V, and PowerPC, mitigating kernel address limit attacks.
• Memory Tagging: Adds support for ARMv8.5 Memory Tagging Extension (MTE) to help eliminate linear heap buffer overflows.
• nosymfollow: A new mount option that disables symlink resolution to defend against untrusted filesystems.

Why it matters

These changes improve the security posture of both cloud environments via SEV-ES and local systems through improved memory safety and reduced attack surfaces.