Loading vulnerability…
Linux kernel fsnotify special-file activity disclosure
CVE-2025-68788 is an information-disclosure vulnerability in the Linux kernel fsnotify subsystem. An unprivileged local user can subscribe through inotify or fanotify to events concerning children of a readable parent directory and receive ACCESS/MODIFY notifications for special files the user cannot read. These notifications reveal other users' read/write activity even though ordinary reads and writes to special files generally do not produce corresponding observable access or modification timestamp changes. The fix suppresses these notifications to parent-directory watchers for special-file reads and writes while preserving notifications associated with explicit timestamp changes through utimensat().
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthorized disclosure of special-file activity creates a timing side channel that can support surveillance and potentially information exfiltration across user boundaries. Demonstrated device-file monitoring revealed keyboard-event timing, but not the specific keys pressed or file contents. No direct integrity or availability impact is established. The patch addresses the special-file notification channel, not all broader file-notification side channels.
If you can’t patch tonight, do this now.
Until patched, limit untrusted local code execution and restrict untrusted users' ability to watch sensitive parent directories containing special files where operationally feasible. Denying read access to the special file alone is insufficient because notifications can be obtained through its parent directory. For affected Siemens devices without fixed firmware, restrict access to the additional GNU/Linux subsystem's interactive shell to trusted personnel and run only trusted applications.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the fsnotify fix that suppresses parent-directory ACCESS/MODIFY notifications for special-file reads and writes, and reboot into the updated kernel. Fixed upstream stable releases include 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. Debian fixes include linux 6.1.162-1 for bookworm and 6.12.69-1 for trixie. Distribution backports use different version numbers; select the fixed package for the deployed product and kernel branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.