Security researchers at Graz University of Technology have revealed that file-notification subsystems in Linux, Windows, Android and macOS leak detailed activity information through side channels, exposing decades-old design flaws across all four platforms[5][8][11]. The work, titled File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS, analyses how these mechanisms can be abused to infer user behaviour without needing direct access to file contents[5][11]. The paper is scheduled for presentation at ACM CCS 2026 in November in The Hague, bringing the issue squarely to the attention of the academic and security communities[5][11].
Modern operating systems ship file-notification APIs such as inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS to inform applications when files are opened, modified, or deleted[5][11]. These interfaces intentionally avoid exposing file contents but allow unprivileged users to monitor rich metadata about file events, including paths, timestamps and operation types, even for files they cannot read directly in some cases[3][5][14]. The researchers demonstrate that this metadata can be turned into powerful side channels enabling inter-keystroke timing attacks, website fingerprinting and user-interface redress attacks that steal credentials on shared or multi-user systems[5][6][11].
On Linux, the issue is formalised as information-disclosure vulnerability CVE-2025-68788 in the kernel’s fsnotify subsystem, where users with access to a parent directory such as /dev can subscribe to ACCESS and MODIFY events on child special files they cannot read[1][3][14]. This behaviour diverges from normal stat() semantics, which do not show atime or mtime changes when other users read and write to special device files, and effectively allows local attackers to infer activity on devices like /dev/input from event streams alone[3][4][6]. By watching /dev/input, the team reports keystroke timing attacks with accuracy scores above 93 percent across multiple users locally and 100 percent over SSH, converting raw access notifications into high-fidelity reconstructions of typed input[5][11]. Kernel maintainers have shipped a partial fix that stops generating ACCESS and MODIFY events on child special files for parent directory watchers, aligning fsnotify events with what stat() reveals and reducing the side-channel risk[1][3][14]. Vendor advisories describe the flaw as moderate in severity, and NVD currently lists no known exploitation in the wild, although the research demonstrates practical attack techniques against unpatched systems[1][2][7]. According to reporting, the mitigation landed in December 2025 in long-term and stable kernels including 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64 and 6.18.3, leaving older releases and bespoke distributions potentially exposed until they adopt the fix[5][9][14].
The situation on Windows is arguably more dramatic: monitoring the root of the C: drive allows a process to receive the full path of every file touched anywhere on the system, across all users, regardless of file permissions[5][11]. Using this stream of path updates, the researchers were able to track which websites another user visited in Firefox in real time, achieving around 97.8 percent accuracy via website fingerprinting techniques derived from observed browser cache and profile activity[5][8]. Microsoft characterised this behaviour as “by design” and an undocumented feature when notified, a stance that later earned a nomination for “lamest vendor response” at the 2026 Pwnie Awards[5][8]. Despite the clear privacy impact on multi-user Windows systems, no patch or configuration change has yet been announced to restrict directory-level monitoring or introduce finer-grained access controls for file-notification APIs[5][8].
On Android, the FileObserver API can monitor file events below the FUSE layer intended to isolate per-app storage, meaning a permissionless application can watch another app’s private directory and infer when messages or media are sent, received or deleted based on filenames and timestamps[5][11]. The team specifically highlights the ability to follow activity in messaging apps such as WhatsApp without any storage permissions, exposing highly sensitive behavioural patterns even though the attacker never reads the message content itself[5][8]. Researchers say they disclosed their findings to Linux, Android, Windows and macOS security teams between August and October 2025, yet Android had not shipped mitigations at the time of publication, leaving the mobile ecosystem vulnerable to abuse of these notification channels[5][8]. Apple’s macOS exposes comparatively less information because no bypass was found for reading private directories, but FSEvents still lets observers track a wide range of system-level changes via updates to .plist files, including audio input and output switches, power and sleep settings, Bluetooth and printer configuration, network cable events, volume mounts, and application installs or removals[5][11].
Collectively, the findings show that file-notification side channels are a cross-platform design issue rather than a single vulnerability, affecting virtually every modern desktop and mobile operating system shipping these APIs[5][8][11]. The authors argue that mitigations must go beyond the current Linux fix by extending capability checks so users can monitor only their own files and readable paths, disallowing whole-drive monitoring on Windows and introducing kernel-level permission systems for notification subscribers on Windows and macOS[5][6][11]. For defenders, the immediate priority is to ensure Linux systems are running kernel builds that incorporate the CVE-2025-68788 fsnotify changes, particularly on shared servers and multi-user workstations where keystroke and activity leakage pose real risk[1][2][14]. Administrators should also treat unrestricted file-notification access as a sensitive capability, auditing which processes register wide-scope watchers, hardening local account policies, and considering host-based monitoring for abnormal use of these APIs while waiting for vendors to deliver more robust architectural fixes.
References
- CVE-2025-68788 – linux.oracle.com
- CVE-2025-68788 Common Vulnerabilities and Exposures | SUSE
- CVE-2025-68788 – Security Bug Tracker – Debian
- EUVD-2026-2320 – European Union
- Decades-old file security flaws found in Android, Linux, macOS, and Windows
- CVE-2025-68788: Linux Kernel Information Disclosure Flaw
- Vulnerability Change Records for CVE-2025-68788 – NVD
- ‘Decades-old’ bugs found affecting Windows, Android, macOS and Linux — but the OS makers don’t see it as a big deal
- Positive Technologies собрала 64 проверки Kubernetes в единый …
- ChatGPT тайно заставили выполнять команды из чужого аккаунта
- CVE-2025-68788
