File-Notification Side Channels Expose User Activity Across Major Operating Systems

Researchers at Graz University of Technology disclosed decades-old side-channel weaknesses in file-notification mechanisms used by Android, Linux, macOS, and Windows. A local unprivileged user can monitor file-event metadata—not file contents—to infer sensitive activity including keystrokes, website visits, authentication prompts, application usage, and connected-device events. On Linux, the exposure involves the inotify filesystem-event interface, which reports monitored filesystem activity to user-space applications.

Linux received a partial mitigation for CVE-2025-68788 in December 2025, but researchers reported no Android mitigation. Microsoft said the Windows behavior is by design. Organizations should restrict untrusted local code execution and review applications that use broad filesystem monitoring, while platform vendors are urged to enforce stronger permissions or capabilities for file-event monitoring—particularly preventing whole-drive monitoring on Windows.