Linux Moving Ahead With Enabling Kernel IBT By Default

As an enhancement to the out-of-the-box Linux kernel in its default x86_64 configuration, it was being eyed to enable Indirect Branch Tracking by default. That change to enable IBT by default has been picked up by TIP's x86/core branch, thus putting it on deck as material for submitting with next month's Linux 6.2 merge window.

Indirect Branch Tracking is part of Intel Control-Flow Enforcement Technology (CET) with Tigerlake CPUs and newer. IBT provides indirect branch protection to defend against JOP/COP attacks by ensuring indirect calls land on an ENDBR instruction.

The Linux kernel has seen a lot of work by Intel engineers and others around Indirect Branch Tracking support as well as recently pursuing FineIBT, which might also be merged for Linux 6.2. The FineIBT approach aims to combine the best of Intel's CET with an alternative Control Flow Integrity (CFI) scheme.

This morning flipping on IBT by default as part of the stock x86/x86_64 Kconfig kernel configuration was merged to TIP's x86/core, so barring any last minute objections or other considerations by Linus Torvalds, it should be set for seeing in Linux 6.2.

Some Linux distribution vendor kernels already ship with the X86_KERNEL_IBT option enabled. For those on CPUs not having the hardware capability for IBT as part of the Control-flow Enforcement Technology, you won't notice any change in behavior, but for those on newer CPUs this is a good default as another layer of in-hardware security protection.