Linux Rootkits Using Advanced eBPF and io_uring Techniques

Linux rootkits have quietly grown into one of the most dangerous threats facing modern infrastructure.

For years, attackers focused primarily on Windows-based systems, but the rise of Linux in cloud environments, container orchestration, IoT, and high-performance computing has shifted that calculus.

Today, threat actors are engineering Linux rootkits that exploit cutting-edge kernel features, making them significantly harder to catch and remove than their predecessors.​

A rootkit is a class of malware built around one core goal: stay hidden. Unlike ransomware or data stealers that announce themselves through damage or demands, rootkits quietly burrow into an operating system and manipulate how it presents information to both users and security tools.

They can conceal processes, hide files, mask network connections, and even suppress their own presence in kernel module lists.

For attackers targeting high-value systems like government servers, telecom infrastructure, or cloud providers, a rootkit that goes undetected for months is far more valuable than one that triggers an immediate alert.​

Elastic Security Labs researchers identified this evolving threat landscape in a detailed two-part research series published on March 5, 2026.

They traced how Linux rootkits have progressed through several distinct generations — from basic shared-object hijacking in the early 2000s, through loadable kernel module (LKM) implants, and now into a modern era defined by eBPF-based implants and io_uring-powered evasion.

Real-world examples such as TripleCross, Boopkit, and the recently documented RingReaper (2025) represent the cutting edge of this progression.​

What makes today’s rootkits particularly concerning is not just their technical sophistication, but how they exploit kernel features that were originally built for legitimate purposes.

Extended Berkeley Packet Filter (eBPF), introduced as a safe in-kernel virtual machine for packet filtering and tracing, has been repurposed by attackers to hook syscalls and intercept kernel events without loading a traditional kernel module.

Similarly, io_uring, a high-performance asynchronous I/O interface introduced in Linux 5.1, has been abused to batch system operations in ways that dramatically reduce the number of observable syscall events — effectively blinding tools that rely on syscall monitoring.​

The impact of this shift is significant. Traditional detection tools like rkhunter and chkrootkit scan for signs of LKM-based compromise, but eBPF implants do not appear in /proc/modules and can bypass Secure Boot restrictions entirely.

This leaves large portions of production Linux environments — particularly those without specialized kernel-level telemetry — operating with a serious blind spot that modern rootkit authors are actively exploiting.​

How eBPF and io_uring Rewrote the Rootkit Playbook

The shift to eBPF represents a fundamental change in how rootkits interact with the Linux kernel.

Rather than writing a malicious loadable kernel module that risks crashing the system or triggering a tainted kernel state, an attacker using eBPF loads bytecode that passes through the kernel’s own verifier before being JIT-compiled into native machine code.

This makes the implant appear more legitimate to the operating system itself.​

eBPF rootkits typically attach their programs to syscall entry tracepoints or Linux Security Module (LSM) hooks, giving them visibility into process execution, file access, and network activity without modifying any function pointers or patching kernel code directly.

Tools like TripleCross demonstrated how eBPF programs could hook the execve syscall to monitor and manipulate process execution, while Boopkit used eBPF to build a covert command-and-control channel hidden inside crafted network packets.​

io_uring complements this by addressing a different detection surface. When a process uses io_uring to perform file reads, writes, and metadata operations, it submits all of those requests in a single batch through shared memory rings rather than triggering individual syscalls for each action.

This means a malicious process conducting large-scale data collection or reconnaissance can do so with minimal syscall-level telemetry — a significant problem for EDR solutions that rely on per-syscall visibility.​

Defenders are not without options. Elastic’s researchers outlined several concrete recommendations for detecting and responding to these threats.

Monitoring for anomalous use of the io_uring_enter and io_uring_register syscalls can reveal processes submitting unusually large operation batches or registering excessive file descriptors.

For eBPF-based threats, organizations should audit all loaded eBPF programs on systems where eBPF tooling is not typically expected, since unexpected programs attached to tracepoints or LSM hooks are a strong indicator of compromise.

Memory forensics, kernel integrity checks, and telemetry gathered below the OS level remain the most reliable methods for identifying rootkits that have successfully concealed themselves from standard userland tools.

Organizations are also advised to enforce kernel lockdown policies, enable module signing, and keep kernels updated — particularly beyond version 6.9, which introduced architectural changes that break older syscall table hooking methods.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.