Linux Rootkits Using Advanced eBPF and io_uring Techniques

This report explains how modern Linux rootkits have evolved to abuse legitimate kernel features—particularly eBPF and io_uring—to remain stealthy in cloud, container, and infrastructure environments; it highlights examples (TripleCross, Boopkit, RingReaper), details evasion techniques that blind traditional detection tools, and recommends auditing eBPF programs, monitoring io_uring syscalls, performing kernel-level telemetry and memory forensics, and enforcing kernel hardening measures.