Securing Linux® with CHERI

CHERI is a hardware approach to memory safety that improves system security at runtime by extending established ISAs, such as ARM, RISC-V, and x86, with new architectural features. This cross-architecture project adapts the Linux Kernel and userspace software to benefit from CHERI’s memory protection and software compartmentalization features.

Talk to Us on Slack

Join the Mailing List

Learn About CHERI

Code Repositories

Get Started on Morello

Features

Spatial memory safety for userspace and the Kernel

Userspace and Kernel debugger support for memory-safe and memory-unsafe code

Runs on Morello boards, Morello FVP, QEMU, and RISC-V FPGA platforms

Monthly News Update: July 2026

CVA6 support, a test suite for POSIX-based OSes and work on glibc
by Paul Metzger

Hesham Almatary’s work at Capabilities Ltd has reached a significant milestone in the platform bring-up of CHERI-CVA6. As a reminder, CHERI-CVA6 is a 64-bit CHERI-RISC-V CPU that’s being …

Accelerating Adoption

Extensive research and development activity has gone into porting a version of FreeBSD, called CheriBSD, to use CHERI’s features, and in particular explore and evaluate the sizeable design space of potential CHERI integrations with a general-purpose, MMU-based operating system. This work has been highly successful, with memory-safe ports of the FreeBSD kernel and userlevel, and over 10,000 open source packages using a CHERI-adapted LLVM toolchain. With a clear set of abstractions defined, and existing prototypes evaluated at scale, efforts to port Linux will be substantially less work.

Our strategy is to maximize portability of CHERI protection, language integration, and APIs across architectures (e.g., Arm’s Morello, CHERI-RISC-V), tools (e.g., LLVM, QEMU, Yocto), and operating systems (e.g., FreeBSD, Linux). This minimizes developer burden in adapting application-level code, ensures that lessons learned in any of these can be broadly benefited from in all, and helps reinforce the message to upstream communities that CHERI protection is a well defined, portable, and consistently implemented model, and sufficiently mature to adopt.