Fedora adopts hardware-enforced protection for x86 memory
The upcoming Fedora 45 release intends to enable Shadow Stack by default, leveraging modern CPU features to neutralize return-oriented programming exploits.
Adrian Volk
Jul 3, 2026 · 1 min read
Memory safety is shifting from a compiler-side problem to a hardware-enforced requirement. Fedora 45 is set to activate x86_64 Shadow Stack protection by default, a move that utilizes Control-flow Enforcement Technology present in current Intel and AMD processors. By maintaining a secondary stack of return addresses that cannot be easily manipulated by malicious code, the system can detect and prevent the execution of return-oriented programming (ROP) attacks.
This implementation is designed for transparency. The dynamic linker will automatically activate the protection for any process where the binary and its shared library dependencies are built with the necessary support. Because Fedora has utilized the required compile-time flags since 2018, the majority of the ecosystem is already prepared. This move establishes the infrastructure for a future rollout of Indirect Branch Tracking, completing the hardware-level defense against jump-oriented exploitation.