> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Decades-old file security flaws found in Android, Linux, macOS, and Windows - URL: https://f4n6.co.uk/security-feed/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/ - Published: 2026-09-24T18:32:30.000Z - Updated: 2026-09-24T18:32:30.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-68788 ## 1\. Executive summary Researchers at TU Graz have published a class of side-channel flaws in the file-notification subsystems that ship with Linux (inotify), Windows (ReadDirectoryChangesW), Android (FileObserver) and macOS (FSEvents), with the oldest of the four dating to 2000\. An unprivileged local user, or a remote user over SSH, can watch file events for files they cannot read, and the researchers convert that stream into keystroke recovery (93.1 to 100 percent accuracy locally, 100 percent over SSH), website fingerprinting (87.9 percent on Linux, 97.8 percent against another user's Firefox browsing on Windows) and a credential-theft prompt redress against KDE Plasma 6 on Wayland. Only the Linux issue carries a CVE (CVE-2025-68788) and only a partial fix, shipped in December 2025 kernels; the verified reference data records no CVSS score, no CISA KEV listing and an EPSS of 0 percent, so nothing here indicates exploitation in the wild. Microsoft has told the researchers the Windows behaviour is by design, and no Android mitigation has appeared. For EMEA financial services the exposure sits on shared multi-user Linux and Windows hosts, jump servers, build and VDI estates, SSH sessions, and Android BYOD devices that can observe other apps' private storage. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | NIS2 Art. 21(2)(d): supply chain security measures | Microsoft classifies the Windows behaviour as by design and no Android mitigation has shipped, so two OS components in the estate carry a known leak that patching cannot close. | Record the vendor position, the compensating controls applied and the residual risk against those OS components in the supply chain risk assessment, rather than closing the item as "awaiting patch". | | DORA Art. 24: digital operational resilience testing — general requirements | The researchers publish reproducible attack templates with measured success rates against production OS components (inoti.fyi), including a 100 percent remote keystroke-recovery result over SSH. | Add a local side-channel scenario to the resilience testing programme, scoped to shared Linux and Windows hosts and to SSH sessions carrying privileged input. | No incident-reporting article is engaged. The material reports no exploitation, no affected institution and no operational disruption, so DORA Art. 17, Art. 18, Art. 19 and NIS2 Art. 23 have no trigger here. ## 3\. Technical analysis & attack chain The attack needs no elevated privilege and no malicious file. It abuses APIs that every one of the four operating systems ships so that applications can be told when files change. 1. The attacker holds an unprivileged account on a multi-user host, or a remote session over SSH. The researchers state the file-notification subsystem is reachable by unprivileged users on all four platforms. 2. The attacker subscribes to the platform's notification API: inotify on Linux, ReadDirectoryChangesW on Windows, FSEvents on macOS, FileObserver on Android. 3. The attacker points the watch at a directory that is readable even when the files inside it are not. On Linux, watching /dev/input produces a notification on every keystroke. On Windows, watching the root of C:\\ reports the full path of every file touched anywhere on the system, across all users, regardless of permissions. 4. The notification stream leaks file paths, event types (access, modify, create, delete) and timestamps. On Linux and Windows this metadata is available without read access to the file itself. 5. The attacker turns the event stream into a side channel. Inter-keystroke timing recovers typed input at 93.1 to 100 percent accuracy across seven users locally, and at 100 percent over SSH. Website fingerprinting identifies visited sites at 87.9 percent across the top 100 sites on Linux, and at 97.8 percent for another user's Firefox browsing on Windows. 6. On KDE Plasma 6 under Wayland the same leak supports an authentication-prompt redress attack that allows credential theft. 7. On Android, FileObserver crosses the FUSE layer that isolates per-app storage, so an app holding no storage permission can watch another app's private directory. Against WhatsApp the researchers recovered, by filename and timestamp, when photos, videos and documents were sent, received or deleted. 8. On macOS the researchers found no bypass for reading private directories, but FSEvents still exposed changes to .plist files: audio input and output changes, power settings changes, Bluetooth device and printer updates, DNS changes triggered by network cable events, volume mount and unmount events, and application installs and removals. **Affected components.** inotify on Linux (present since 2005), FileObserver on Android (since 2008), ReadDirectoryChangesW on Windows (since 2000), FSEvents on macOS (since 2007). The researchers note that the set of globally readable files is extensive, which is what makes the watch targets easy to find. **Linux remediation state.** CVE-2025-68788 was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64 and 6.18.3\. The patch stops "access" and "modify" events being generated on special files in /dev/. It does not close the wider class. The researchers propose extending capability checks to monitoring one's own files and to any readable file. **Windows and macOS remediation state.** Microsoft's position is that the behaviour is by design and is an undocumented feature; the researchers' paper records that response, which was nominated for the lamest vendor response at the Pwnie Awards 2026\. The paper proposes disallowing the monitoring of entire drives on Windows, and introducing a kernel permission system on Windows and macOS covering context, access control, owned files and directories, and minifilters. Neither proposal is implemented. **Disclosure timeline.** The researchers state they reported to the Linux, Android, Windows and macOS security teams between August and October 2025\. No mitigation has appeared for Android. macOS yielded the least information of the four. **Confidence caveat.** This item is single-sourced. Every accuracy figure above comes from the researchers' own measurements as reported by The Register, and none has been independently reproduced in the material available to us. The paper is scheduled for ACM CCS 2026 in The Hague in November, so at the time of writing it has not passed through that venue's review. The verified reference data records CVE-2025-68788 with no CVSS score, not in CISA KEV, EPSS 0 percent, which is consistent with a non-exploited research finding rather than an active campaign. Treat the attack techniques as demonstrated in a laboratory setting, not as observed in the wild. ## 4\. Mitigation & containment ### P1, within 24 hours - Inventory Linux kernels across the estate and identify any host below 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64 or 6.18.3 on the corresponding stable branch. Upgrade to those versions or later to pick up the /dev/ special-file fix, and record that the fix is partial. - Treat every unprivileged local account and every SSH account on a shared host as able to run these attacks. Remove interactive shell access from service accounts and reduce the number of users permitted to log on locally to jump hosts, build servers and VDI images. - On Windows there is no vendor fix. Restrict local logon on servers to named administrators and review which processes legitimately need to watch whole drives. ### P2, within 72 hours - Windows compensating controls: the source proposes disallowing the monitoring of entire drives. Where a minifilter or EDR product can enforce that, apply it. Otherwise alert on processes opening directory handles against C:\\ root or against whole drive letters. - Android: no mitigation exists. Through MDM, restrict sideloading and untrusted app sources, and inventory apps on devices that hold corporate data. Treat any installed Android app as able to observe other apps' file activity by filename and timestamp. - macOS: no bypass for private directories was found, so the residual leak is .plist metadata. Include audio, power, Bluetooth, printer, DNS, volume mount and application install paths in host monitoring. - SSH: the remote inter-keystroke attack reached 100 percent accuracy. Adverse Trace recommends disabling password authentication over SSH in favour of key-based authentication, which removes the typed-secret value from the timing channel. The source does not propose this; it is our recommendation. ### P3, within 7 days - KDE Plasma 6 on Wayland: the authentication-prompt redress attack targets the desktop session. Where Plasma 6 Wayland runs on shared or kiosk endpoints, test the prompt behaviour and consider an alternative session type until a fix is available. - Add a local side-channel scenario to the resilience testing programme, covering shared Linux and Windows hosts and SSH sessions that carry privileged input. - Track vendor advisories for Android and Windows and re-test when fixes ship. No vendor fix is currently available for either. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The item describes abuse of legitimate operating system APIs rather than a malicious file, so there are no hashes, domains, addresses or file artefacts to publish. The sources do describe observable behaviours. These are single-sourced from the TU Graz paper as reported by The Register and should be validated against local baselines before enforcement. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | ---------------------------- | | A process subscribes to an inotify watch on /dev/input or a parent directory, producing file events that track keystrokes | Linux hosts, auditd file-watch or eBPF file telemetry | low to medium, single source | | A process calls ReadDirectoryChangesW against C:\\ root or a whole drive letter, returning paths for files it cannot read | Windows hosts, ETW Microsoft-Windows-Kernel-File or minifilter telemetry | low to medium, single source | | An app uses FileObserver against another app's private data directory, including messaging app media folders | Android devices, app-behaviour telemetry or MDM | low to medium, single source | | A process subscribes to FSEvents on .plist paths under the user preferences directory, tracking audio, power, Bluetooth, printer, DNS or volume changes | macOS endpoints, endpoint detection telemetry | low, single source | | Repeated short-interval file access events on /dev/input that correlate with user typing | Linux hosts, auditd | low, single source | ## 6\. Detection No YARA rule is provided. The item describes abuse of legitimate OS APIs, not a malicious file, so there are no file artefacts, strings or command-line flags to match. A rule built from the CVE identifier or the product names would detect reporting about the flaw rather than the flaw itself. One Sigma rule is provided for the Linux watch target named in the source. The Windows behaviour is not covered because Sigma's standard log sources do not capture ReadDirectoryChangesW; detecting it requires ETW Microsoft-Windows-Kernel-File or a minifilter, and the source supplies no artefacts for a portable rule. The exclusion list below is deliberately empty: populate it with the display servers, input libraries, accessibility tools and remote-desktop agents in use before enabling this as an alert. ```yaml title: Process opening /dev/input event devices for file-notification monitoring id: 8f2c1a44-3b7e-4d19-9a02-6c5e7b1d0f31 status: experimental description: > Detects a process opening character devices under /dev/input, the watch target the TU Graz File Notification Attacks paper uses to turn inotify events into a local inter-keystroke timing attack. Tune the exclusion list to the input daemons and display servers in use before enabling as an alert. references: - https://inoti.fyi - https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672 author: Adverse Trace date: 2026/09/24 logsource: product: linux service: auditd detection: selection: type: SYSCALL name|startswith: '/dev/input/' condition: selection falsepositives: - Display servers, input libraries, accessibility tools and remote-desktop agents that read input devices by design - Container runtimes and device passthrough for input devices level: low ``` ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---- | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-68788](https://nvd.nist.gov/vuln/detail/CVE-2025-68788?ref=f4n6.co.uk) | — | — | 0% | In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child fo… | ## 7\. Sources - The Register, "Decades-old file security flaws found in Android, Linux, macOS, and Windows", https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672, 2026-09-24. - Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss (TU Graz), "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS", summary at https://inoti.fyi, paper scheduled for ACM CCS 2026, The Hague, November 2026. ## 8\. Adverse Trace position The verified reference data gives CVE-2025-68788 no CVSS score, no CISA KEV entry and an EPSS of 0 percent, and the source reports no exploitation in the wild, so we assess immediate operational risk to most EMEA financial services clients as low. The risk concentrates where untrusted or semi-trusted users share a host with sensitive input: jump servers, build and CI hosts, VDI images, kiosk endpoints and any Linux or Windows system where a low-privilege account can watch a broad directory. Android BYOD is the second exposure, because a permissionless app can observe another app's file activity and no fix exists. This item is single-sourced from one research group's measurements, and we have not independently reproduced the accuracy figures; treat them as laboratory results until the paper is presented at ACM CCS 2026\. We will track vendor advisories for Android and Windows, watch for a CVSS assignment or any in-the-wild reporting against CVE-2025-68788, and re-issue this advisory if either changes the assessment. Clients who need the side-channel scenario folded into a DORA Art. 24 testing plan should contact their Adverse Trace analyst. --- [Read the original source →](https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*