"We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz.
File-notification subsystems on Linux, Android, Windows, and macOS
Researchers at Austria's Graz University of Technology report that core file-notification mechanisms — inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS — can act as side channels that leak timing and path information about file activity. The systems were designed to tell applications when files are opened, changed, written, or deleted; they do not disclose file contents. But the researchers say event metadata alone can be exploited to infer sensitive activity across user accounts.
Linux: CVE-2025-68788 and the /dev/input keystroke channel
The team identified a Linux vulnerability tracked as CVE-2025-68788. Their tests show that watching a readable directory can leak events for files inside it that an attacker cannot otherwise read. The paper gives a striking example: watching /dev/input produces notifications on every keystroke. Using that channel, the researchers turned file events into an inter-keystroke-timing attack with reported local keystroke accuracy of 93.1–100 percent across seven users and a remote (SSH) accuracy at 100 percent.
Part of the Linux issue was partially mitigated in December 2025: kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3 were patched to prevent generation of "access" and "modify" events on special files in /dev/.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogAndroid FileObserver bypasses FUSE isolation and exposes app storage
On Android, the researchers found that FileObserver can bypass the FUSE layer meant to isolate per-app storage. The paper describes a permissionless app that can watch another app's private folder — the researchers cite WhatsApp as an example — and learn the filenames and timestamps of photos, videos, and documents when they are sent, received, or deleted. The authors report that they disclosed these findings to security teams between August and October 2025, but the source notes no mitigation appears to have been made for Android devices.
Windows ReadDirectoryChangesW and macOS FSEvents: full-path, plist, and device events
On Windows, the team reports that watching the root directory C:\ can report the full path of every file touched anywhere on the system, across users and regardless of permissions. The researchers say this was sufficient to track which websites another user visits in Firefox in real time with a reported 97.8 percent accuracy. According to the paper, Microsoft told the researchers the behavior is "by-design" and undocumented; that response was nominated for the lamest vendor response at the Pwnie Awards 2026.
macOS presented a different profile: the researchers tell us Apple provided the least information because they found no bypasses for reading private directories. Still, FSEvents allowed monitoring of changes recorded in .plist files that reveal a range of system and application events, including audio input/output changes, power setting adjustments, Bluetooth device and printer updates, DNS changes initiated by a network cable, volume mount/unmount events, and application installations and removals.
Measured attacks, proposed mitigations, and academic publication
The Graz University of Technology team — Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss — present their findings in a paper titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS." The paper is scheduled to appear at ACM CCS 2026 this November in The Hague, Netherlands, and is summarized at inoti.fyi.
As remedies, the authors argue capability checks should be extended: they recommend preventing even readable special device files from emitting certain events, and they propose platform-specific changes such as disallowing monitoring of entire drives on Windows and introducing a kernel permission system on Windows and macOS (for context, access control, owned files and directories, minifilters). They note parts of the Linux problem have already been addressed for device files by the December 2025 kernel changes.
What this means for security teams, end users, and vendors
- Security teams and OS maintainers: The researchers' proposals point to changes in kernel behavior and capability checks; the Linux kernel received partial fixes in December 2025, but the paper calls for broader checks on readable files and device nodes.
- End users and administrators: The attacks demonstrated include local account cross-user inference (keystrokes, website visits, file actions) and remote SSH scenarios; device owners should note the specific mitigations already applied to Linux kernels and that Android remedies were not reported as available.
- Vendors (Windows and macOS): The authors suggest architectural additions such as per-file/directory monitoring permissions and blocking whole-drive monitoring on Windows; Apple and Microsoft were given responsible disclosure timelines but have differing public responses, per the researchers' account.
The basic tension the researchers flag is simple and stark: file-notification systems are useful and necessary, yet their event metadata can betray user activity in ways the original APIs did not anticipate. The authors show measurable, cross-platform exploitation techniques and offer concrete kernel-level proposals; whether vendors adopt those changes before attackers weaponize the described channels is now the urgent question.
Source: The Register — Decades-old file security flaws found in Android, Linux, macOS, and Windows
