Researchers at Graz University of Technology say built-in file-notification features in Linux, Android, macOS, and Windows can leak sensitive activity such as keystroke timing, website visits, and app file actions to low-privilege attackers. The issue affects Linux inotify, Android FileObserver, Windows ReadDirectoryChangesW, and macOS FSEvents; Linux is tracked as CVE-2025-68788 and was partially fixed in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3, while the researchers say Android had no mitigation at publication.
Why it matters: This is not just a theoretical bug: the researchers showed attacks that can infer typing, track visits to websites, and observe activity in other apps without needing full access to the files themselves. Linux admins should verify kernel updates for CVE-2025-68788, and defenders on all affected platforms should review exposure to untrusted local users and app-level monitoring until broader mitigations arrive.
Eduard Kovacs
2026.09.25
98% relevant
This is another report on the same Graz University research into file-notification side channels across Linux, Android, Windows, and macOS. It adds concrete demonstrations including Linux keystroke-timing leakage, Firefox website fingerprinting, Android WhatsApp media-event leakage, Windows cross-user path disclosure from the system drive root, and notes that only the Linux device-file issue has a partial fix tracked as CVE-2025-68788.
2026.09.24
100% relevant
This article appears to be the first tracked item here tying the same underlying event together: a new academic disclosure about cross-platform file-notification side-channel leakage, with Linux CVE-2025-68788 and vendor response details.
← Back to all stories