Linux rootkit "Curing" exploits the io_uring interface to execute commands without invoking traditional system calls, effectively bypassing detection by security tools that rely on system call monitoring.
https://thehackernews.com/2025/04/linux-iouring-poc-rootkit-bypasses.htm
