CVE-2025-68788

Root

Cause

The vulnerability stems from the fsnotify subsystem in the Linux kernel, which was generating ACCESS and MODIFY events for child special files (e.g., /dev/null) even when the watching user lacks read access to the file itself. While inotify and fanotify enforce permissions on direct file watches, they allowed users with read access to the parent directory to monitor children for file events. For regular files, users could indirectly infer access/modification via atime/mtime stat calls, but special files do not generally exhibit such timestamp changes. The inconsistency created a side-channel where event notifications could leak information about file accesses not otherwise observable.

Exploitation

An attacker with read access to a parent directory (e.g., /dev) but no read access to a special file (e.g., /dev/null) could subscribe to events on that directory and observe ACCESS/MODIFY events generated when other users read from or write to the special file. This attack does not require elevated privileges beyond normal file-system access. The issue was identified in research on file notification attacks [as noted in a published paper], and this patch closes that information leak.

Impact

By exploiting this side-channel, an attacker can infer when other processes or users interact with special files, potentially leaking sensitive information such as timing of operations or usage patterns. The impact is primarily information disclosure, which could aid in further attacks or surveillance.

Mitigation

The fix has been backported to multiple stable kernel trees via commits [1], [2], and [3]. Users are advised to update their Linux kernel to include these patches. There is no workaround short of applying the patch or restricting access to parent directories of special files.