You could also just compile your kernel with things like stack zeroing enabled and eat the 0.1% performance hit in exchange for not getting owned by classic exploits :(