CVE-2025-68788

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fsnotify: do not generate ACCESS/MODIFY events on child for special files<br /> <br /> inotify/fanotify do not allow users with no read access to a file to<br /> subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the<br /> same user to subscribe for watching events on children when the user<br /> has access to the parent directory (e.g. /dev).<br /> <br /> Users with no read access to a file but with read access to its parent<br /> directory can still stat the file and see if it was accessed/modified<br /> via atime/mtime change.<br /> <br /> The same is not true for special files (e.g. /dev/null). Users will not<br /> generally observe atime/mtime changes when other users read/write to<br /> special files, only when someone sets atime/mtime via utimensat().<br /> <br /> Align fsnotify events with this stat behavior and do not generate<br /> ACCESS/MODIFY events to parent watchers on read/write of special files.<br /> The events are still generated to parent watchers on utimensat(). This<br /> closes some side-channels that could be possibly used for information<br /> exfiltration [1].<br /> <br /> [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf