Back Gbhackers

VoidLink Rootkit Leverages eBPF and Kernel Modules to Stealthily Infiltrate Linux Systems

Gbhackers •Mayura Kathir • March 26, 2026

VoidLink is a new Linux rootkit family that combines classic kernel modules with eBPF to hide processes and network activity deep inside modern cloud environments. It targets distributions from CentOS 7 up to Ubuntu 22.04, giving attackers a stealthy way to persist across a wide range of kernel versions. VoidLink is part of a broader […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Emergence of VoidLink Rootkit Threatens Linux Systems with Advanced Evasion Techniques The VoidLink rootkit has been identified as a significant threat to Linux systems, utilizing a combination of Loadable Kernel Modules (LKMs) and extended Berkeley Packet Filter (eBPF) programs for stealthy infiltration. First documented by Check Point Research in January 2026, this malware framework targets a wide range of Linux distributions, including CentOS 7 and Ubuntu 22.04, allowing attackers to hide processes and network activity effectively. The rootkit's design enables it to persist across various kernel versions, posing a risk to cloud-native environments. As of now, specific CVEs related to VoidLink have not been disclosed, but its capabilities suggest a high potential for exploitation. Security professionals are advised to monitor their systems closely for signs of compromise. The full scope of the threat remains under investigation, with ongoing assessments of its impact on cloud infrastructure. 2 sources 62

Extracted Entities

VoidLink Rootkit Leverages eBPF and Kernel Modules to Stealthily Infiltrate Linux Systems

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

Platforms (2)