Graz TU file-notification side channels (SecurityWeek 25 Sep): inotify / ReadDirectoryChangesW / FSEvents / FileObserver leak activity — Linux CVE-2025-68788 partial
SecurityWeek (Eduard Kovacs, 25 September 2026) and project site inoti.fyi summarise Graz University of Technology research (“File Notification Attacks”) showing that OS file-change notification APIs — Linux inotify, Windows ReadDirectoryChangesW, macOS FSEvents, Android FileObserver — can be abused by an unprivileged local account (or a no-permission Android app) to reconstruct other users’ activity from event names and timing without reading file contents. Demonstrated: Linux inter-keystroke timing (93.1–100% F1), Firefox website fingerprinting (87.9% top-100), KDE Plasma 6 Wayland fake-password-prompt overlay; Windows full-path leakage under drive-root watches including other users’ homes (Firefox top-1000 97.8%); Android WhatsApp media send/receive/delete metadata; macOS least leakage but still app launch / settings / connectivity signals. Linux partially mitigated Dec 2025 (no access/modify events on special/device files) as CVE-2025-68788 in kernels 5.10.248 / 5.15.198 / 6.1.160 / 6.6.120 / 6.12.65 / 6.18+. Microsoft optional registry EnforceDirectoryChangeNotificationPermissionCheck; researchers list no Android/macOS patches. PoC on GitHub (isec-tugraz/file-notification-attacks). No known in-the-wild exploitation per researchers. Primary: inoti.fyi + paper PDF; wire: SecurityWeek 25 Sep.
- Product
- Linux inotify; Windows ReadDirectoryChangesW; macOS FSEvents; Android FileObserver
- Versions
- Cross-version design class; Linux partial fix CVE-2025-68788 in 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.65+, 6.18+; Windows optional permission-check policy; Android/macOS: no vendor fix listed by researchers
- Exploited in Australia?
- unknown
- Patch to
- Apply Linux kernels with CVE-2025-68788 mitigation; on Windows enable EnforceDirectoryChangeNotificationPermissionCheck per Microsoft guidance; harden multi-user / shared Android device app installs; treat local untrusted code as able to observe FS event metadata even without file read rights.
Primary: inoti.fyi — File Notification Attacks (Graz TU) · Vendor: Paper PDF — File Notification Attacks (Graz TU) · CVE: CVE-2025-68788 · SecurityWeek — File notification systems leak user activity (25 Sep 2026)