Back Cybersecuritynews

VoidLink Rootkit Uses eBPF and Kernel Modules to Hide Deep Inside Linux Systems

Cybersecuritynews •Tushar Subhra Dutta • March 26, 2026

A new and technically advanced rootkit called VoidLink has emerged as a serious threat to Linux systems, blending Loadable Kernel Modules (LKMs) with extended Berkeley Packet Filter (eBPF) programs to hide deep inside the operating system’s core. First documented by Check Point Research in January 2026, VoidLink is a cloud-native Linux malware framework written in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Emergence of VoidLink Rootkit Threatens Linux Systems with Advanced Evasion Techniques The VoidLink rootkit has been identified as a significant threat to Linux systems, utilizing a combination of Loadable Kernel Modules (LKMs) and extended Berkeley Packet Filter (eBPF) programs for stealthy infiltration. First documented by Check Point Research in January 2026, this malware framework targets a wide range of Linux distributions, including CentOS 7 and Ubuntu 22.04, allowing attackers to hide processes and network activity effectively. The rootkit's design enables it to persist across various kernel versions, posing a risk to cloud-native environments. As of now, specific CVEs related to VoidLink have not been disclosed, but its capabilities suggest a high potential for exploitation. Security professionals are advised to monitor their systems closely for signs of compromise. The full scope of the threat remains under investigation, with ongoing assessments of its impact on cloud infrastructure. 2 sources 62

Extracted Entities

VoidLink Rootkit Uses eBPF and Kernel Modules to Hide Deep Inside Linux Systems

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (2)