Reported by 8 outlets
Decades-old file security flaws found in Android, Linux, macOS, and Windows
Why this score
- Breadth
- 2.00 / 2.0 · 8 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Researchers at Graz University of Technology documented how file-change notification APIs built into Linux, Windows, macOS, and Android leak other users' activity to any unprivileged local process. The work, "File Notification Attacks," was presented at ACM CCS 2026 and spans inotify, FSEvents, ReadDirectoryChangesW, and the Android per-app storage model. The attacker only needs read access to a watched folder, not to the files inside it: directory events reveal file names and event timing, which is enough to reconstruct what a victim is doing.
The demonstrated leaks are concrete. Watching the folders that hold keyboard device files exposes keystroke timing, and with seven test typists the attack detected keystrokes at 93.1 to 100 percent accuracy, enough to reconstruct typed text given two decades of keystroke-timing research. The same templating approach identifies application launches, visited websites, SSH sessions via cross-user inter-keystroke timing, USB usage, VPN activity, and printing. On Android, an app with no permissions can abuse per-app storage bypasses.
Vendor responses are uneven. Linux merged commit 635bc4def026 by Amir Goldstein on December 15, 2025, stopping fsnotify from delivering ACCESS/MODIFY events to parent watchers for special files such as /dev, with stable branches unaffected from 5.10.248, 5.15.198, and 6.1.160 onward; NVD tracks the issue as CVE-2025-68788 and Siemens flags the SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at V3.1.6 and earlier. The Linux fix is explicitly partial, since utimensat still generates parent events. Microsoft documented the Windows side as CVE-2025-21197 and CVE-2025-27738 and shipped a FILE_LIST_DIRECTORY access check in updates from April 8, 2025, but it is disabled by default behind the EnforceDirectoryChangeNotificationPermissionCheck policy value, and Microsoft told researchers it does not consider the behavior a security vulnerability.
Watch whether organizations actually enable the opt-in Windows check, whether the remaining Linux event paths get closed, and whether Android addresses the permission-free variant. Multi-user servers, shared workstations, and converged IT/OT hosts running Siemens hardware have the most exposed threat model, since any low-privilege account or no-permission app becomes a surveillance implant.
Timeline
-
original reporting
Decades-old file security flaws found in Android, Linux, macOS, and Windows
theregister.com · 19d ago · September 24th, 2026
submitted by /u/homothebrave [link] [comments]
via reddit r/cybersecurity: Decades-old file security flaws found in Android, Linux, macOS, and Windows
-
update from support.microsoft.com
Access check enhancements to prevent unauthorized disclosure of file paths (KB5058189)
support.microsoft.com · 554d ago · April 8th, 2025
Microsoft documents a Windows vulnerability, referenced as CVE-2025-21197 and CVE-2025-27738, where a user with FILE_LIST_DIRECTORY rights on a parent folder obtains directory change notifications revealing full paths of files they cannot access. A fix shipped in Windows updates on or after April 8, 2025, performing a FILE_LIST_DIRECTORY access check before reporting changes. The fix is disabled by default and must be enabled via the EnforceDirectoryChangeNotificationPermissionCheck registry or group policy value under HKLM\SYSTEM\CurrentControlSet\Policies or Control\FileSystem.
-
update from git.kernel.org
fsnotify: do not generate ACCESS/MODIFY events on child for special files
git.kernel.org · 302d ago · December 15th, 2025
Mainline Linux commit 635bc4def026 by Amir Goldstein, committed by Jan Kara on December 15, 2025, stops fsnotify from delivering ACCESS/MODIFY events to parent-directory watchers for special files such as those under /dev, closing the keystroke-timing side channel. Reported by Sudheendra Raghav Neela of TU Graz, marked for stable, and the commit message cites the researchers' paper PDF. The description notes events are still generated to parent watchers via utimensat(), so the mitigation is partial.
-
update from nvd.nist.gov
CVE-2025-68788 detail (NVD record)
nvd.nist.gov · 274d ago · January 13th, 2026
The NVD record for CVE-2025-68788, published January 13, 2026 with kernel.org as source, describes the fsnotify behavior allowing a user with no read access to a file but read access to its parent directory to observe access/modify events, aligned with stat-based atime/mtime semantics. It lists fix commits and shows affected Linux ranges with stable branches unaffected from 5.10.248, 5.15.198, and 6.1.160 onward. Siemens additionally flags the SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at V3.1.6 and earlier as affected.
-
update from inoti.fyi
ALRIGHT! I'm VERY excited to announce this research, because we've been holding onto it for close to a year now! Announcing File Notificatio
inoti.fyi · 19d ago · September 24th, 2026
ALRIGHT! I'm VERY excited to announce this research, because we've been holding onto it for close to a year now! Announcing File Notificatio
via Mastodon https://inoti.fyi/
-
update from inoti.fyi
File notification systems (inotify, FSEvents, ReadDirectoryChangesW) leak information about other processes' activity
inoti.fyi · 19d ago · September 25th, 2026
File notification systems (inotify, FSEvents, ReadDirectoryChangesW, and siblings) can leak information about other processes' activity to any local process holding only read permission, the core finding of the "File Notification Attacks" research presented at ACM CCS 2026. The project's reference site documents the attacks across Linux, Android, Windows, and macOS, including cross-user inter-keystroke timing over SSH, privacy violations through per-app storage bypasses, and visited-website identification from directory watches.
-
update from securityweek.com
Windows, Linux, Android File Notification Systems Leak User Activity
securityweek.com · 18d ago · September 25th, 2026
Researchers at Graz University of Technology in Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm of their typing to the websites they visit. Linux, Windows, macOS, and Android let applications ask to be alerted when files are created, modified, or deleted. Text editors, file managers, sync clients, and antivirus products are among the programs that use this capability. It requires no elevated privileges, only read access to the location being watched. The attacks never expose file contents, but the researchers demonstrated that file names and the timing of events are enough to reconstruct user, application, and system activity. Most of the attacks require an adversary who can already run code on the machine under a separate account. On Android, it would be an app that requests no permissions. On Linux, a user who is denied permission to watch a protected file can still receive its events by watching the folder that contains it, as long as that folder is readable. Applied to the device files that represent keyboard input, this reveals when a user presses a key, though not which key. Research going back more than two decades has shown that the intervals between keystrokes can help infer what is being typed. In tests with seven typists, the attack reliably detected keystrokes, scoring between 93.1% and 100% on a standard accuracy measure. Input that produ
-
mentioned by www.securityweek.com
Microsoft: "We thank the researcher for reporting this behavior. We investigated and determined that this is not a security vulnerability. T
www.securityweek.com · 18d ago · September 25th, 2026
-
update from cyberpress.org
File Notification Attacks Let Unprivileged Users Spy on Activity Across Windows, Linux and macOS
cyberpress.org · 14d ago · September 29th, 2026
The attacks exploit filesystem event APIs intended for legitimate software features such as file synchronization, editors, antivirus tools , and file managers. New File Notification Attacks Let Unprivileged Users Spy These mechanisms notify subscribed applications when filesystem operations occur, including file access , creation, modification, deletion, opening, and closing. The research, titled File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS , shows how attackers can transform otherwise routine notification events into high-resolution activity surveillance. The attack model assumes a malicious but unprivileged process running locally as a separate user, without administrator access or specialized hardware. File-notification templating attacks (Source: inoti) The researchers developed a templating method that records filesystem event patterns while users perform specific activities. Attackers can then match later notification sequences to these templates to identify user actions, such as launching applications,
-
update from gbhackers.com
File Notification Attacks Let Hackers Track Keystrokes and Website Visits on Linux, Windows and macOS
gbhackers.com · 14d ago · September 29th, 2026
These attacks can expose details such as keystroke timing, application launches, website visits, USB usage, VPN activity, printing, and other behaviors, even when the attacker lacks administrative privileges. […] The post File Notification Attacks Let Hackers Track Keystrokes and Website Visits on Linux, Windows and macOS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by inoti.fyi
The paper "File Notification Attacks" reveals a generic side-channel leakage problem across Linux, Windows, and macOS. Researchers found tha
inoti.fyi · 14d ago · September 29th, 2026