What is the file-notification vulnerability and why does it matter?
All major operating systems use a file-notification subsystem designed to inform applications when files on the system change, but not the details of those changes. Security researchers have discovered that this subsystem harbors decades-old side-channel vulnerabilities allowing attackers with limited permissions to infer sensitive information.
This matters because side-channel attacks exploit indirect system cues — such as timing or event notifications — to gather secrets like keystrokes, visited websites, or even credentials, without needing direct access to the data. The flaw exists in subsystems like inotify (Linux), FileObserver (Android), ReadDirectoryChangesW (Windows), and FSEvents (macOS), some dating back over 20 years.
How can attackers exploit these bugs?
By monitoring file-change notifications from directories they have read access to, attackers can deduce user activities indirectly. For example, watching directories like /dev/input on Linux leaks file events corresponding to every keystroke, enabling inter-keystroke timing attacks with over 90% accuracy in controlled tests. These attacks can:
- Infer typed input locally or remotely over SSH
- Track websites visited by analyzing related file events
- Potentially steal login credentials through UI manipulation techniques
The attack leverages the fact that unprivileged users can monitor notifications on files readable by multiple users, which are more common than expected.
Why haven’t these bugs been widely fixed?
Side-channel attacks can be technically challenging to execute reliably, which may explain why operating system vendors have largely not prioritized patching them despite being informed a year ago. Linux deployed partial mitigations (CVE-2025-68788) to reduce event notifications on certain sensitive files, but this only addresses a portion of the overall problem.
Microsoft considers the behavior of ReadDirectoryChangesW to be "by design" and does not view this as a flaw requiring a patch, arguing that monitoring file paths across users is not a vulnerability. Apple has acknowledged the findings but has not implemented any publicly known mitigations.
What risks do users face and how can they protect themselves?
The practical risk is that local or remote attackers with access to the system could infer sensitive user inputs or activities without elevated privileges. While not trivial to exploit, the potential privacy and security implications are significant, especially in multi-user or shared environments.
Users should:
- Keep systems updated with the latest security patches, especially on Linux where partial fixes exist
- Limit unprivileged user access to directories containing sensitive input or activity logs
- Be cautious with remote access and SSH usage, as some attacks work remotely
- Use additional security layers such as encryption, two-factor authentication, and dedicated credential managers to reduce impact if credential theft occurs
Practical takeaway for security-conscious users
Though these file-notification subsystem vulnerabilities have existed for years, their exploitation requires sophisticated side-channel techniques and specific conditions. However, they highlight the importance of minimizing unnecessary file-read permissions and being vigilant about multi-user system security. Linux users benefit from partial mitigations, but Windows and macOS users should stay alert for any future updates addressing these issues. Employing strong endpoint security practices remains the best way to reduce exposure to such subtle side-channel attacks.