Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers affiliated with Austria's Graz University of Technology have found flaws in the implementation of file notification systems on Android, Linux, macOS, and Windows that leak potentially compromising system information.

"We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Register.

Affected systems include inotify on Linux since 2005, FileObserver on Android since 2008, ReadDirectoryChangesW on Windows since 2000, and FSEvents on macOS since 2007.

These file notification subsystems tell the operating system when a file has been opened, changed, written, or deleted.

They don't reveal file contents.

But file event information functions as a side channel that allows a malicious user to infer the activities of other users of the computer.

Armed with file event data, an attacker may be able to conduct inter-keystroke-timing attacks that reveal user input (not only locally but remotely over SSH), website fingerprinting attacks that reveal website visits, and UI redress attacks that allow credential theft.

Neela and colleagues Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss describe their findings in a paper titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS." The paper, summarized at inoti.fyi, says the basic problem is that unprivileged users can access the file notification subsystem and that on Linux and Windows file information is available even without read access.

The attack scenarios mostly involve a local attacker who has access to an account with files that can be read by multiple users.

The researchers however note that the list of globally readable files is extensive.

Neela said, "On Linux, watching a readable directory leaks events on files inside it you cannot even read: watching /dev/input gives a notification on every keystroke, which we turn into a local inter-keystroke timing attack with a 93.1–100 percent [keystroke accuracy] score across seven users and a remote (SSH) one at 100 percent." He added that the group also carried out an authentication-prompt redress attack on KDE Plasma 6 under Wayland, and website fingerprinting on the top 100 sites at 87.9 percent.

The Linux vulnerability (CVE-2025-68788) was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3.

The patch prevents the generation of "access" and "modify" events on special files in /dev/.