New FlipSwitch Hooking Method Overcomes Linux Kernel Defenses

A new rootkit hooking method named FlipSwitch has emerged, aimed at overcoming Linux kernel defenses by targeting the compiled dispatcher rather than the deprecated sys_call_table. According to GBHackers, FlipSwitch restores syscall hooking by patching the machine-level call instruction inside x64_sys_call, enabling interception of critical system calls such as kill and getdents64.

The method unfolds in four stages: discovering the original function address from sys_call_table, locating kallsyms_lookup_name via a kprobe, scanning for the unique call instruction signature in x64_sys_call, and patching the dispatcher by disabling the WP bit in CR0 and redirecting the call to a fake_kill handler; the original offset is restored on module unload.

The researchers note that Linux kernel 6.9 replaced the direct array lookup with a switch statement, which FlipSwitch exploits to bypass modifications to sys_call_table. To aid defenders, Elastic Security has published a YARA rule targeting the PoC, and the piece suggests runtime integrity verification, tighter kprobe restrictions, and improved control-flow integrity as defensive measures. October 1, 2025.