New Linux Rootkit ‘Curing’ Evades Detection via io_uring Exploit

A new proof-of-concept rootkit dubbed Curing highlights a critical blind spot in Linux runtime security tools by abusing the io_uring interface to operate without triggering system call monitors. The technique effectively bypasses traditional defenses used by major security solutions.

---

io_uring: A Legitimate Kernel Feature with Stealth Potential

First introduced in Linux kernel 5.1 in March 2019, io_uring is a system call interface designed for high-performance asynchronous I/O operations. It utilizes a submission queue (SQ) and completion queue (CQ) to reduce the overhead of traditional syscalls by allowing user-space applications to interact with the kernel more efficiently.

But this same performance boost presents a double-edged sword: malicious code can leverage io_uring to perform operations without invoking common system calls — a method increasingly exploited to evade detection.