Linux 6.10's Hardening Configuration Now Enables KCFI & Other Features

Written by Michael Larabel in Linux Kernel on 22 May 2024 at 12:53 PM EDT. 5 Comments
Introduced last year with the Linux 6.7 kernel was a hardening configuration to allow for "make hardening.config" as an easy way of building a security-hardened Linux kernel with sane defaults. With Linux 6.10 there are some additional security minded features now enabled.

Most notably, the Linux 6.10 hardening configuration now enables the Clang Kernel Control Flow Integrity (KCFI) protections. This only works if using LLVM Clang rather than GCC as the compiler for building the kernel.

make hardening.config

The hardening updates for Linux 6.6 also include enabling CONFIG_UNWIND_PATCH_PAC_INTO_SCS to enable the shadow call stack dynamically using code patching. CONFIG_X86_KERNEL_IBT is also enabled for the Control-flow Enforcement Technology (CET) Indirect Branch Tracking (IBT) functionality when running on newer processors. Plus the hardened kernel build now enables CONFIG_PAGE_TABLE_CHECK and CONFIG_PAGE_TABLE_CHECK_ENFORCED to enforce the page table checking by default.

There are also other kernel hardening updates that were sent in as part of the hardening pull request last week for Linux 6.10 and has since been merged.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week