Linux 7.3 randomizes the stack at syscall entry and consolidates kernel ASLR
Merged this week for Linux 7.3, the stack randomization rework led by Thomas Gleixner moves the computation to the earliest possible point and unifies the architecture-specific code. Maintainers of hardened systems have a reason to watch this merge window.
August 21, 2026. Phoronix reports a stack randomization rework merged this week into the Linux 7.3 kernel. Thomas Gleixner of Intel led the work. August 2026. Linux 7.2 has just shipped, and the 7.3 merge window is already absorbing hardening changes.
For a hardened-system maintainer, the story fits in one sentence: kernel ASLR is decided at the exact moment the stack is set up, and for years that moment arrived too late on several architectures.
Stack randomization, the quiet pillar of ASLR
Address Space Layout Randomization — ASLR — rests on a simple principle: make a process’s memory addresses unpredictable to break exploits that assume constancy. Users know it mostly through /proc/sys/kernel/randomize_va_space, which governs the randomization of the stack, heap, mmap regions and executable.
Stack randomization is its most sensitive link. On every syscall entry, the kernel adds a random offset to the stack pointer, so two successive calls do not place their stack at the same address. That is what complicates stack-overflow exploits, stack pivoting and ROP chains that rely on predictable addresses.
The problem is not the principle, it is the execution. The randomization was scattered through each architecture’s low-level entry code, and at points that were sometimes wrong — before the processor state was even established.
What Gleixner consolidated
Thomas Gleixner’s rework covers the common code as well as PowerPC, LoongArch, RISC-V, s390 and x86/x86_64. The goal, phrased in the pull request, is to “consolidate stack randomization for the generic entry code and the architectures using it.”
The starting observation is precise: stack randomization on syscall entry was “sprinkled throughout the architecture specific low level entry code and in some cases at the wrong points, e.g. before establishing state, which violates the non-instrumentable constraints of that code.”
The fix integrates randomization directly into the generic entry helpers, so it is invoked “at the earliest possible point right after establishing state,” and converts every architecture using the generic entry path. The benefit is twofold: the stack is randomized before a single word of instrumentable code runs, and the logic stops being duplicated across as many variants as there are architectures.
# Check the state of address space randomization
cat /proc/sys/kernel/randomize_va_space # 2 = stack + heap + mmap + executableA second lever: the ability to disable SUD
The same merge series brings a second, security-oriented change: making Syscall User Dispatch — SUD — cleanly disableable. SUD lets a user-space process intercept selected syscalls and redirect them to a handler, a mechanism useful to emulators and sandboxes, but one that also widens the kernel’s attack surface.
Two control points appear: the CONFIG_SYSCALL_USER_DISPATCH build-time option to cut it at compile time, and the runtime kernel.syscall_user_dispatch parameter to drive it without recompiling. For a hardening profile, that is the ability to reduce the attack surface of a feature you do not use, instead of living with it.
# Disable Syscall User Dispatch at runtime on a 7.3 kernel
sysctl kernel.syscall_user_dispatch=0Why this change lands now
The timing is not incidental. Linux 7.2 shipped in August 2026, and the 7.3 merge window — with a release expected toward the end of the year — is where deep changes land. That a rework touching the syscall entry path of every call is accepted in the window says something about its maturity: it has been reviewed enough to touch the most sensitive code in the kernel.
The stakes go beyond maintainers. On every syscall, the stack offset is now applied at the earliest point, before any instrumentable code. The gain is not spectacular in benchmarks — randomization costs almost nothing in cycles — but it is measured in closed windows of opportunity: an exploit that counted on a predictable stack during the first instructions of a syscall loses that assumption.
Verdict
If you maintain hardened systems, change nothing urgently: the rework lands with Linux 7.3, and your distributions will carry it at their own pace. What deserves your attention is the reading: when 7.3 arrives, make sure your hardening profiles that touched SUD go through the new controls — CONFIG_SYSCALL_USER_DISPATCH or kernel.syscall_user_dispatch — rather than ad hoc patches.
If you follow the kernel closely, take away the method as much as the result: a security hardening gains reliability when it leaves per-architecture code for the generic path. That is the exact opposite of fragmentation, which leaves divergent variants and holes depending on the architecture.
The rule to remember: kernel security is decided in microseconds, at the very start of a syscall. Moving stack randomization “as early as possible” is not a cosmetic detail — it is closing the window where the stack was still predictable.