# Linux v5.10 introduces major security hardening and architectural changes

> **Key takeaway:** Linux v5.10 includes significant security improvements ranging from AMD SEV-ES support to the removal of set_fs() on several architectures.

**Published:** 2022-04-05T00:01:05+00:00 
**Source:** Kees Cook (Linux Kernel Security) 
**Category:** pioneer-voices 
**Canonical URL:** https://fosswire.org/news/security-things-in-linux-v510.html 

## Summary
The Linux v5.10 release introduced several security-focused updates, including register state encryption for AMD SEV-ES and static calls for x86 to mitigate Spectre-related overhead. The kernel also saw the removal of set_fs() for x86, RISC-V, and PowerPC architectures, and the introduction of a nosymfollow mount option to prevent symlink-based attacks.

## Key security enhancements in v5.10
- **AMD SEV-ES**: Adds register state encryption to prevent VM hosts from reconstructing guest VM states.
- **x86 Static Calls**: Replaces indirect function calls with direct calls, eliminating the need for RETPOLINE mitigations and improving performance in hot-paths.
- **Network RNG**: Replaces the internal pRNG with the **SipHash** round function to prevent brute-forcing of network sequence numbers.
- **Architecture Cleanup**: Completely removes **set_fs()** for x86, RISC-V, and PowerPC, mitigating kernel address limit attacks.
- **Memory Tagging**: Adds support for **ARMv8.5 Memory Tagging Extension (MTE)** to help eliminate linear heap buffer overflows.
- **nosymfollow**: A new mount option that disables symlink resolution to defend against untrusted filesystems.

## Why it matters
These changes improve the security posture of both cloud environments via SEV-ES and local systems through improved memory safety and reduced attack surfaces.