Linux Security Summit Europe 2025
2025-08-28..2025-08-29
Amsterdam, Netherlands
[Linux Security Summit Europe 2018, Linux Security Summit Europe 2019, Linux Security Summit Europe 2022, Linux Security Summit Europe 2023, Linux Security Summit Europe 2024, Linux Security Summit Europe 2025]
as the organisers put it
register Sponsor Sponsorship Benefits Complete Sponsorship Agreement submit to Speak VIEW THE SCHEDULE Thank you to all who joined us for Linux Security Summit 2025! We look forward to seeing you at…
who it's for
kernel developers, linux security engineers, security researchers, distribution maintainers, platform engineers, bootloader developers, embedded systems engineers
topics
CHERI capability architecture; IMA user-space reimplementation; CVE triage with EPSS/CVSS; arm64 protection keys for kernel; AppArmor CI and rewrites; SELinux LSM syscalls and tooling; upstreaming hardware security features; FineIBT BHI speculative defense; execveat AT_EXEC_CHECK script control; Landlock JSON and TOML policy; eBPF for securing CI/CD runners; recoverable tamper-resistant distributed FDE
| title | author | length |
|---|---|---|
| Welcome + Opening Remarks | Elena Reshetova | 04m |
Conference logistics and content updates: no live stream this year, all talks are recorded except birds of a feather sessions, recordings appear on the site in… | ||
| Linux and CHERI: Back to the Future | Carl Shaw | 53m |
CHERI is a capability CPU extension that replaces pointers with 128-bit capabilities, already running a Linux kernel port that reaches kernel 6.16 purecap and… | ||
| IMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space | Roberto Sassu | 28m |
A user-space reimplementation called AlIMA user-space reimplementation reproduces 99% of Linux IMA behavior to enable test-driven development, fuzzing and… | ||
| Prioritizing the Linux OS Hardening and CVE Mitigation | Baoli Zhang | 20m |
Analysis of Linux kernel CVEs since 2021 drives a concrete triage: prioritize by CVSS base metrics first, cross‑reference EPSS probabilities and whether a CVE… | ||
| Kernel Hardening With Protection Keys | Kevin Brodsky | 30m |
Implements a KB keys framework that uses hardware protection keys (pkeys/permission overlay) on arm64 to make high-value kernel data page tables and struct… | ||
| AppArmor Update | John Johansen | 39m |
Activity shows 2,000+ commits and 141 contributors in six months; CI now boots VMs (Spread and imagegarden) to test multiple distros and kernels instead of… | ||
| SELinux Update | Paul Moore | 19m |
Kernel and userland SELinux updates focus on concrete features and numbers: new LSM syscalls to list/get/set LSM attributes, deprecating the niche selinuxfs… | ||
| Opportunities and Challenges on Merging HW Security Features into Linux Mainline Kernel | Kevin Brodsky, James Morris, Carl Shaw, Scott Constable, Elena Reshetova | 42m |
Hardware features that land quickly share concrete properties: clear ABI compatibility, a simple enable path, and at least one large adopter. Examples… | ||
| Welcome Back + Remarks | Elena Reshetova | 02m |
Morning welcome outlines day logistics: program finishes around 3:00 p.m., with a break and an adjacent room reserved for BOFs where proposals can be posted on… | ||
| FineIBT Enhanced: Hardening Linux’s Microarchitectural Security on X86 | S. Constable, S. Österlund | 58m |
FineIBT enhanced as FineIBT+ BHI injects 32-bit type hashes at indirect call sites and uses cmove sequences to poison live registers on a hash mismatch… | ||
| Script Integrity | Mickaël Salaün | 23m |
Linux 6.14 adds a concrete kernel capability to control script execution: a new execveat(2) AT_EXEC_CHECK flag plus prctl successors to O_MAYEXEC, and two new… | ||
| Landlock Config | Mickaël Salaün | 40m |
Landlock Config defines a concrete, composable policy format implemented as JSON and TOML files plus a Rust library with C bindings that parses, composes and… | ||
| Securing CI/CD Runners Through eBPF | Mert Coskuner, Cenk Kalpakoglu | 20m |
An open source runtime agent called control.dev uses an eBPF agent and Golang to monitor CI/CD runners for malicious install-time behavior, tracking TCP/UDP… | ||
| Recoverable, Tamper-resistant Full-disk Encryption at the Distributed Edge | Kobus van Schoor | 34m |
A practical, open-source framework that encrypts disks on TPM-equipped edge devices and adds automated recovery, monitoring and remote access; it uses Clevis… | ||
| Hardening the Barebox Bootloader | Ahmad Fatoum | 38m |
Adds a disclosure process and security.md plus a security consideration chapter, integrates fuzzing with libFuzzer and ASAN/UBSAN to test file type, JWT, FIT… | ||
| nothing matches | ||