How a Microsoft Patch Nearly Crashed Linux: Code Review, CFI, and Open‑Source Lessons

Recently, a Microsoft‑contributed code change intended to improve x86_64/AMD64 performance was pushed to the Linux kernel without the required acknowledgment (Ack) from the kernel maintainers. This oversight almost caused the Linux 6.13 release to fail.

The patch unintentionally broke the CPU's Control Flow Integrity (CFI) mechanism, which relies on shadow stacks and Indirect Branch Tracking (IBT) to prevent ROP and JOP attacks. Disabling CFI could have left systems unstable and vulnerable.

Intel engineer Peter Zijlstra and AMD engineer Borislav Petkov quickly identified the problem, noting that the patch introduced massive chaos in the alternative.c file and left some CFI variants in a state that could crash systems. Both criticized the lack of prior review and coordination.

They submitted an emergency fix that restored the kernel's stability, allowing Linux 6.13 to be released safely. The incident sparked intense discussion within the open‑source community about the necessity of rigorous code‑review processes, especially when external corporations contribute.

Key takeaways include the critical role of thorough code audits, the need for clear communication between kernel maintainers and external contributors, and the importance of preserving security features like CFI during performance optimizations.

Going forward, the Linux kernel team plans to strengthen its review mechanisms, improve collaboration with outside developers, and ensure every change undergoes comprehensive testing and verification before integration.