Technology

Linux kernel keyring enables fileless execution of ELF payloads without execve

A research demonstration leverages kernel memory storage to bypass disk and standard execution calls, according to Hacker News.

Updated Sep 12, 2026 · 06:47 UTC1 reports

The short version

A demonstrated technique executes ELF binaries without using execve or touching the filesystem by relying on the Linux kernel keyring.[Hacker News]
Payload data is stored directly in slab memory under security/keys/user_defined.c, completely avoiding disk storage.[Hacker News]
Execution is achieved by manually parsing ELF headers and mapping PT_LOAD segments directly into anonymous memory.[Hacker News]
Default unprivileged user quotas restrict storage to 20,000 bytes across keys, whereas root users can access up to 25 megabytes.[Hacker News]

The method executes an ELF payload without writing to the filesystem or invoking the execve syscall by utilizing the Linux kernel keyring.[Hacker News]
Payload bytes are held in slab memory via user-defined kernel key functionality without engaging filesystem layers.[Hacker News]
The execution flow manually parses program headers and maps PT_LOAD segments into anonymous memory.[Hacker News]
Standard user accounts are bounded by a default combined key quota of 20,000 bytes, whereas root accounts have a 25 megabyte ceiling.[Hacker News]

Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.