Underground eBPF rootkit tutorials show how Linux implants hide from routine checks
Flare researchers found underground forum posts sharing eBPF rootkit code that hides running processes and activates when it receives a specially crafted packet, slipping past checks that look for loaded kernel modules (BleepingComputer, citing Flare).
- Affected
- Linux kernel through 4.4 for CVE-2017-16995 (vendor CNA)
- Fixed
- None listed in supplied vendor CNA record
eBPF programs run inside the kernel through the normal bpf() interface instead of as loadable modules, so a routine lsmod listing will not reveal them. A Russian-language guide on the Duty Free forum described hooking getdents64 to hide directory entries and triggering an implant with a TCP SYN packet carrying a specific window size; it also encrypted command-and-control traffic with AES-256-GCM (BleepingComputer, citing Flare).
Synacktiv separately documented LinkPro in October 2025 after an exposed Jenkins server compromise; LinkPro tried to conceal its eBPF programs from bpftool prog list, though investigators could still see associated BPF maps and links (BleepingComputer).
Organizations should audit loaded eBPF programs with bpftool prog list, restrict unprivileged bpf access, and watch for unexpected XDP programs on network interfaces (BleepingComputer, citing Flare).
Sources & technical scope 2 sources
BleepingComputer — original source ↗
debian CNA / CVE Program — original source ↗
Affected: Linux kernel through 4.4 for CVE-2017-16995 (vendor CNA)
Fixed: None listed in supplied vendor CNA record
Exploitation: Observed in one investigated compromise (LinkPro, October 2025); no KEV catalog entry supplied
Scope & limitations: Version scope beyond kernels through 4.4 is not established; the unverified kTLS/eBPF sockmap PoC claiming kernels 4.18 onward is incorrect, and Ubuntu 22.04/24.04 privilege escalation is unverified (E1 Q8).
External findings belong to the credited researchers.