Recent findings from researchers at Graz University of Technology have unveiled a significant vulnerability affecting the file-notification subsystems across major operating systems, including Linux, Windows, macOS, and Android. This discovery, which highlights decades-old flaws, raises concerns about the potential for side-channel attacks that could enable malicious actors to infer sensitive information such as keystrokes and visited websites.
- Graz University researchers found decades-old flaws in file-notification subsystems across Linux, Windows, macOS, and Android.
- Side-channel attacks can infer keystrokes, visited websites, or even steal credentials via unprivileged access.
- Linux shipped partial mitigations (CVE-2025-68788); Microsoft and Apple acknowledged but did not patch, demo expected at ACM CCS 2026.
The vulnerability, categorized as a side-channel attack, allows threat actors to observe system operations and extract confidential information through indirect clues. For instance, by monitoring power consumption of the chip, attackers can potentially deduce passwords. This alarming discovery was made by a team of researchers, including Sudheendra Raghav Neela, Xufan Zhao, and others, who have been investigating these security flaws.
Notifying the system
The identified side-channel vulnerability resides in the file-notification subsystem, a crucial component that alerts applications to changes in files on the system. Notably, this subsystem does not disclose what has changed, only that a change has occurred. The researchers noted that these bugs have persisted for decades across various operating systems.
“We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change,” explained Sudheendra Raghav Neela in correspondence with The Register.
In Linux, this subsystem is known as inotify, which has been vulnerable since 2005. Android employs FileObserver, affected since 2008, while Windows uses ReadDirectoryChangesW, flawed since the year 2000. On macOS, the subsystem is referred to as FSEvents, with vulnerabilities dating back to 2007.
The researchers assert that information from file events can allow attackers to deduce the activities of other users on a shared computer. They can execute inter-keystroke timing attacks, revealing user inputs both locally and remotely, and potentially pilfer login credentials through UI redress techniques.
No patch
The crux of the issue lies in the fact that unprivileged users can access the file notification subsystem, particularly concerning files that are readable by multiple users. This access creates opportunities for exploitation, as many files on a system fall into this category.
Neela elaborated, “On Linux, watching a readable directory leaks events on files inside it you cannot even read: watching /dev/input gives a notification on every keystroke, which we turn into a local inter-keystroke timing attack with a 93.1–100% [keystroke accuracy] score across seven users and a remote (SSH) one at 100%.”
While the attack may not be universally effective, the inherent challenges associated with side-channel attacks likely explain the lack of urgency among operating system developers. The researchers notified the OS makers about these vulnerabilities approximately a year ago, yet most have not taken significant action to address them. Linux has implemented some mitigations, including CVE-2025-68788, which limits certain notifications for special files. However, this fix only partially addresses the broader attack techniques outlined by the researchers.
Microsoft and Apple acknowledged the findings but have not made substantial changes. Microsoft stated that the behavior of ReadDirectoryChangesW was “by-design,” suggesting that monitoring file paths across users is not considered a vulnerability warranting a patch. The report indicates that Apple has not taken any action regarding the issue either.
