New Linux Rootkits Leverage Advanced eBPF and io_uring Techniques for Stealthy Attacks

This report explains the evolution of Linux rootkits toward using built-in kernel features—primarily eBPF and io_uring—to hide execution, hook syscalls, and batch operations for detection evasion; it highlights proof-of-concept tools and argues defenders must adopt low-level monitoring to counter these stealthy, living-off-the-land techniques.