eBPF Rootkits May Hide Activity from Linux Security Tools

Linux security investigators face a growing challenge from rootkits that abuse Extended Berkeley Packet Filter (eBPF), a kernel technology widely used for performance monitoring, networking and security telemetry.

In a report published on 14 October, security researcher Andrea Fortuna examined how eBPF-based rootkits, including LinkPro and VoidLink, can interfere with the visibility relied upon by endpoint detection and response (EDR) tools. Because defensive sensors and malicious programs may operate at the same kernel level, compromised systems can potentially conceal activity from the tools monitoring them.

The reported techniques include manipulating kernel interfaces to hide loaded eBPF programs, suppress process or network information, and detect analysis utilities. As a result, commands such as bpftool and ss may provide incomplete or misleading results on a compromised machine.

This creates a significant challenge for digital forensics. Investigators traditionally examine running processes, network connections, kernel modules and system logs to reconstruct activity. However, when malware manipulates the interfaces that expose this information, live-system output cannot automatically be treated as trustworthy evidence.

The report recommends acquiring a memory image before rebooting a suspected system, where technically and legally feasible. Volatile memory may preserve evidence of loaded eBPF programs and other kernel state that would disappear after a restart. Investigators should also consider trusted acquisition methods, kernel-integrity checks and independent telemetry.

The findings highlight an important principle in Linux incident response: the operating system being examined may not provide a complete or reliable account of its own state. Investigators must assess the trustworthiness of their collection methods and corroborate findings using independent evidence.