Decades-old file security flaws found in Android, Linux, macOS, and Windows
TU Graz researchers showed file-notification side channels on Linux, Windows, Android, and macOS leak user activity.
TU Graz researchers reported side channels in file-notification subsystems: Linux inotify since 2005, Android FileObserver since 2008, Windows ReadDirectoryChangesW since 2000, and macOS FSEvents since 2007. Unprivileged users can observe file events, and on Linux and Windows that works without read access. Their tests included keystroke timing via /dev/input at 93.1–100% local accuracy and 100% over SSH, 87.9% website fingerprinting, a KDE Plasma 6 Wayland prompt-redress attack, WhatsApp folder monitoring on Android, and Windows root watches tracking Firefox visits at 97.8%. Linux CVE-2025-68788 was partly fixed in December 2025; Android remained unmitigated and Microsoft called the Windows behavior by-design. The paper is scheduled for ACM CCS 2026.
- File-event APIs on Linux, Android, Windows, and macOS leak local user activity.
- Linux CVE-2025-68788 partially blocked access and modify events on /dev files.
- Keystroke timing via /dev/input reached 93.1–100% accuracy, including over SSH.
- Windows drive watches expose full paths; Microsoft called the behavior by-design.
- Permissionless Android apps can timestamp files inside WhatsApp's private folder.
Vulnerabilities mentionedAll →
- CVE-2025-68788—<1%Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users…published · Linux kernel
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-68788 | Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users… In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev). Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change. The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat(). Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1]. [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf |
Full article731 words · extracted from theregister.com · click to collapse
Security researchers affiliated with Austria's Graz University of Technology have found flaws in the implementation of file notification systems on Android, Linux, macOS, and Windows that leak potentially compromising system information.
"We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Register.
Affected systems include inotify on Linux since 2005, FileObserver on Android since 2008, ReadDirectoryChangesW on Windows since 2000, and FSEvents on macOS since 2007.
REG AD
These file notification subsystems tell the operating system when a file has been opened, changed, written, or deleted. They don't reveal file contents. But file event information functions as a side channel that allows a malicious user to infer the activities of other users of the computer.
REG AD
Armed with file event data, an attacker may be able to conduct inter-keystroke-timing attacks that reveal user input (not only locally but remotely over SSH), website fingerprinting attacks that reveal website visits, and UI redress attacks that allow credential theft.
Neela and colleagues Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss describe their findings in a paper titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS."
The paper, summarized at inoti.fyi, says the basic problem is that unprivileged users can access the file notification subsystem and that on Linux and Windows file information is available even without read access.
The attack scenarios mostly involve a local attacker who has access to an account with files that can be read by multiple users. The researchers however note that the list of globally readable files is extensive.
Neela said, "On Linux, watching a readable directory leaks events on files inside it you cannot even read: watching /dev/input gives a notification on every keystroke, which we turn into a local inter-keystroke timing attack with a 93.1–100 percent [keystroke accuracy] score across seven users and a remote (SSH) one at 100 percent."
He added that the group also carried out an authentication-prompt redress attack on KDE Plasma 6 under Wayland, and website fingerprinting on the top 100 sites at 87.9 percent.
The Linux vulnerability (CVE-2025-68788) was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. The patch prevents the generation of "access" and "modify" events on special files in /dev/.
"On Android, FileObserver goes past the FUSE layer meant to isolate per app storage, so a permissionless app can watch (for example) WhatsApp's private folder and see, by filename and timestamp, exactly when photos, videos, and documents are sent, received, or deleted," said Neela.
REG AD
Though the researchers claim that they responsibly disclosed their findings to security teams for Linux, Android, Windows, and macOS between August and October 2025, no mitigation appears to have been made for Android devices.
Apple's macOS provided the least information because no bypasses were found for reading private directories. But FSEvents still allowed the monitoring of various file changes that show up in .plist files. These include audio input and output changes, power settings changes, Bluetooth device and printer updates, network cable-initiated DNS changes, and volume mount/unmount events. Application installations and removals can also be observed.
"On Windows, watching the root directory C:\ reports the full path of every file touched anywhere on the system, across all users, regardless of permissions, enough to track which websites on Firefox another user visits in real time at a 97.8 percent [accuracy] score," said Neela.
"Microsoft told us this is 'by-design' and that it's an undocumented feature. This response was nominated for the lamest vendor response at the Pwnie Awards 2026."
The authors argue that file-notification attacks affect all major operating systems and that further mitigations are needed. They note that despite the protection for device files that has been implemented already, capability checks should be extended to monitoring one's own files and to any readable file.
"On Windows, we propose disallowing the monitoring of entire drives," they state in their paper. "On Windows and macOS, the kernel could introduce a permission system (for context, access control, owned files and directories, minifilters)."
The researchers' paper is scheduled to appear at ACM CCS 2026 this November in The Hague, Netherlands. ®