Revolutionary Rootkit Exploits Linux io_uring, Eludes Traditional Threat Detection

At a glance

• New Rootkit Exploitation: A proof-of-concept rootkit called ‘Curing’ uses Linux’s io_uring interface to work out of sight.
• Advanced Evasion Techniques: It avoids the system calls that many Linux security tools watch.
• Implications for Cybersecurity: The research exposes a blind spot in current threat detection.
• Key Industry Reactions: Researchers are urging changes to how Linux security tools monitor systems.

A blind spot in Linux monitoring

Researchers at security firm ARMO have released a proof-of-concept rootkit called “Curing” that abuses io_uring, a Linux interface built to speed up input/output (I/O) operations, to slip past common threat detection tools. Linux runs most enterprise servers and cloud workloads, so the finding matters well beyond one product.

How Curing uses io_uring

io_uring is a relatively new part of the Linux kernel that handles asynchronous I/O efficiently. It lets programs do things like read files and open network connections without making the usual system calls. Many runtime security tools detect malicious behavior by hooking those system calls, so a program that uses io_uring instead can operate largely unseen.

ARMO said tools that rely on system-call hooks, including Falco and Microsoft Defender for Endpoint on Linux, missed Curing’s activity in its tests.

What makes it hard to catch

Traditional rootkits often modify system binaries or inject code into running processes. Curing instead does its work through io_uring operations, which sidesteps detection and forensic tools that only monitor standard system calls.

ARMO published the code on GitHub so defenders can test their own tools. According to its research, Tetragon could catch this activity only when configured with the right Kprobe or LSM hooks. Security vendors will need to update how they monitor kernel activity.

What it means for Linux security

The research exposes a real gap. Attackers can turn legitimate kernel features against defenders.

Security teams can act now. Where applications don’t need io_uring, it can be blocked with seccomp policies. Defenders should also alert on unexpected io_uring use and adopt monitoring based on kernel security hooks rather than system calls alone.

Vendors are being pushed to rethink their approach, looking for unusual behavior that system-call monitoring misses and building visibility deeper into the kernel through hooks that can see what a process does no matter which interface it uses to do it.

What Linux teams should check

Organizations that rely on Linux should check whether their security tools can see io_uring activity. Detection and prevention need to account for abuse of newer kernel interfaces like this one.

Curing shows that features added for performance can create security blind spots. No system is beyond risk, and defenses have to keep evolving.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.