Do Son 
The Fedora Linux project plans to enable shadow stack protection by default in its upcoming version 46. The change targets 64-bit x86 systems and aims to strengthen their security posture.
This feature was originally slated for Fedora 45. However, outstanding compatibility issues with NVIDIA drivers and certain Python applications pushed the rollout back to version 46, as documented in the project’s change proposal.
What Shadow Stack Protection Does
Shadow stack is a component of Intel’s Control-flow Enforcement Technology, or CET. Recent AMD processors support it as well. The mechanism maintains a separate, protected copy of each function’s return address.
When an attacker exploits a memory vulnerability and tampers with a return address on the call stack, the shadow copy lets the system detect the mismatch. Consequently, it blocks return-oriented programming attacks, one of the most common exploitation techniques.
Fedora has built its packages with the relevant compiler flags since 2018. As a result, a large share of system components and applications already carry shadow stack support markers. What Fedora 46 will do is activate the protection at runtime by default.
For ordinary users, the change should be invisible. No manual toggle is needed, and the performance impact is negligible. One caveat applies, though. Shadow stack requires fairly recent hardware, specifically Intel 11th-generation processors and later, or AMD Zen 3 and later.
Third-Party Software May Need Adjustments
The risk to Fedora’s own packages is minimal. The main concern lies with third-party binary libraries, closed-source drivers, hand-written assembly, and certain dynamically loaded modules.
If an application already carries shadow stack support but loads a library at runtime that is incompatible, the result could be a failed launch or a failed library load.
This is precisely why the project postponed the default. The delay gives maintainers more time to resolve compatibility issues. The system also offers a temporary opt-out, so users and developers can work around the handful of applications that do not yet comply.
One further clarification deserves attention. Intel CET also includes indirect branch tracking, or IBT. Fedora’s current proposal covers only shadow stack. IBT falls outside this change, and whether Fedora will enable it by default in future depends on subsequent compatibility and maintenance assessments.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
