Decades-old file security flaws found in Android, Linux, macOS, and Windows
TU Graz researchers showed file-notification side channels on Linux, Windows, Android, and macOS leak user activity.
TU Graz researchers reported side channels in file-notification subsystems: Linux inotify since 2005, Android FileObserver since 2008, Windows ReadDirectoryChangesW since 2000, and macOS FSEvents since 2007. Unprivileged users can observe file events, and on Linux and Windows that works without read access. Their tests included keystroke timing via /dev/input at 93.1–100% local accuracy and 100% over SSH, 87.9% website fingerprinting, a KDE Plasma 6 Wayland prompt-redress attack, WhatsApp folder monitoring on Android, and Windows root watches tracking Firefox visits at 97.8%. Linux CVE-2025-68788 was partly fixed in December 2025; Android remained unmitigated and Microsoft called the Windows behavior by-design. The paper is scheduled for ACM CCS 2026.
- File-event APIs on Linux, Android, Windows, and macOS leak local user activity.
- Linux CVE-2025-68788 partially blocked access and modify events on /dev files.
- Keystroke timing via /dev/input reached 93.1–100% accuracy, including over SSH.
- Windows drive watches expose full paths; Microsoft called the behavior by-design.
- Permissionless Android apps can timestamp files inside WhatsApp's private folder.
- CVEs
- CVE-2025-68788
- Organizations
- Graz University of TechnologyACM
- Countries
- AustriaNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-68788 | Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users… | — | <1% |
From the original article
3 min read at theregister.comSecurity researchers report that Microsoft considers the side-channel leak of file events to be by design
By Thomas Claburn · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.