Hidden in Plain Sight: A Critical Linux Security Flaw in io_uring
A serious vulnerability has emerged in the Linux security landscape, revealing that many modern runtime protection tools fail to detect threats leveraging the io_uring interface.
This overlooked flaw creates a significant blind spot across Linux systems powering cloud infrastructures and enterprise data centers globally.
Researchers at ARMO have uncovered that top-tier security tools—including CrowdStrike Falcon, Microsoft Defender, Falco, and Tetragon—are essentially “blind” to malicious activity carried out via io_uring. This interface, introduced in Linux 5.1, enables high-performance asynchronous I/O by bypassing traditional system calls—rendering many monitoring tools ineffective.
Since most commercial Linux runtime security solutions depend on system call tracking to identify suspicious behavior, the implications are broad and serious.
To highlight the risk, ARMO built and released a proof-of-concept rootkit named Curing. This rootkit operates solely through io_uring and can establish command-and-control channels, exfiltrate sensitive files, and execute payloads—all without triggering alerts from standard detection tools.
“We decided to create Curing and release it publicly to raise awareness about io_uring as an overlooked mechanism that attackers can exploit,” ARMO explained in their report.
Despite io_uring being in the kernel for several years and previously flagged as a potential security risk, the gap in vendor monitoring capabilities remains largely unaddressed.
Major Security Tools Fail to Detect Rootkits Leveraging io_uring
Researchers uncovered troubling findings when testing popular security tools against rootkits built on the io_uring interface. According to their report, CrowdStrike’s Falcon agent failed to detect sensitive file access operations executed via io_uring, effectively bypassing its file system monitoring capabilities entirely.
Microsoft Defender for Endpoint on Linux also missed several critical signals, including malware deployment and suspicious outbound connections—highlighting serious gaps in threat detection.
A senior vice president at a leading cybersecurity firm acknowledged the gravity of the issue, stating, “We take this very seriously as it bypasses all our file system visibility.”
Mixed Responses from Security Vendors
Reactions from vendors have varied. CrowdStrike promptly recognized the vulnerability and released a fix to enhance visibility into io_uring-based activity. SentinelOne, meanwhile, reported that their agent was not affected by this particular flaw.
Microsoft, however, was reportedly unresponsive to multiple contact attempts from the research team—a concerning lack of engagement given the severity of the findings.
Open-source projects offered a spectrum of responses. Falco maintainers confirmed the problem and are actively developing a plugin to provide deeper visibility. Tetragon developers clarified that their tool can detect io_uring activity, but only if explicitly configured to do so—underscoring the importance of default settings in security effectiveness.
Next Steps: Modernizing Detection Strategies
To close this security gap, the researchers outlined several potential approaches for vendors:
- Monitoring for abnormal use of io_uring
- Leveraging KRSI (Kernel Runtime Security Instrumentation) for deeper integration with the kernel
- Exploring alternative hook points throughout the Linux stack
KRSI provides native hooks into the Linux security subsystem, offering fine-grained insight into kernel-level operations. It’s a powerful and evolving toolset well-suited to the demands of modern security monitoring, the team explained.
Given Linux’s foundational role in cloud environments and data centers, this vulnerability represents a broad risk across industries. The researchers stress that vendors must evolve beyond syscall-based detection to keep pace with increasingly stealthy and sophisticated attack techniques.
