CVE-2025-68788: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68788 is an information disclosure vulnerability in the Linux kernel's fsnotify subsystem, specifically in how ACCESS/MODIFY events are generated for special files (e.g., /dev/null). A low-privileged local user with read access to a parent directory (such as /dev) can exploit inotify/fanotify to monitor when other users read from or write to special files, creating a side-channel for information exfiltration. The vulnerability was published on January 13, 2026, and affects Linux kernel versions from the initial commit up to the patched releases (Red Hat CVE, Feedly). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an inconsistency in the Linux kernel's fsnotify framework (CWE not formally assigned): inotify/fanotify correctly prevent users without direct read access to a file from subscribing to per-file events, but they permit those same users to subscribe to child-watching events on a parent directory they can read (e.g., /dev). For regular files, this is partially mitigated because atime/mtime changes are observable via stat(), aligning with the event behavior. However, for special files (character/block devices, pipes, etc.), atime/mtime are not updated on read/write by other users — only on explicit utimensat() calls — meaning the fsnotify events leak access information that is not otherwise observable. The fix modifies fsnotify to suppress ACCESS/MODIFY event generation to parent directory watchers on read/write operations of special files, while still allowing events triggered by utimensat(). The academic paper referenced in the commit describes the broader class of file-notification side-channel attacks (Feedly).

An attacker with a low-privilege local account and read access to a parent directory (such as /dev) can use inotify/fanotify to infer when other users or processes are reading from or writing to special files, even without direct read access to those files. This constitutes an information disclosure side-channel that could reveal sensitive system activity — for example, detecting when privileged processes interact with specific device files — potentially aiding in reconnaissance or timing attacks. The impact is limited to confidentiality; there is no integrity or availability impact (Feedly, Red Hat CVE).

1. Gain local access: Obtain a low-privilege shell on a target Linux system running a vulnerable kernel version (prior to 6.1.160, 6.6.120, 6.12.64, 6.18.3, or 6.19-rc2).
2. Identify target special files: Enumerate special files in directories accessible to the attacker (e.g., /dev/null, /dev/random, /dev/urandom) where the attacker has read access to the parent directory but not necessarily to the file itself.
3. Set up inotify/fanotify watcher: Use the inotify_add_watch() syscall (or a tool like inotifywait) to watch the parent directory (e.g., /dev) for IN_ACCESS and IN_MODIFY events on child entries.
4. Monitor events: Observe incoming fsnotify events to determine when other users or processes read from or write to the special files, inferring system activity patterns without direct file access.
5. Correlate activity: Cross-reference event timing with other observable system signals to infer which processes or users are interacting with sensitive device files, enabling reconnaissance or timing-based attacks (Feedly).

• Process: Unusual use of inotify_add_watch() or fanotify_mark() syscalls by low-privilege processes watching /dev or other special-file directories; processes such as inotifywait running under non-administrative accounts.
• Logs: Audit log entries (auditd) showing inotify_add_watch or fanotify_mark syscalls from unexpected user accounts targeting /dev or similar directories.
• File System: No persistent file artifacts are expected, as this is a purely in-memory, syscall-based side-channel attack.

Apply the upstream kernel patches that modify fsnotify to suppress ACCESS/MODIFY events to parent directory watchers on read/write of special files. Fixed versions include Linux kernel 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc2 (Feedly). Distribution-specific updates are available from Red Hat, Debian (DSA-6126-1, DLA-4475-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, Amazon Linux 2, and Microsoft Azure Linux (azl3_kernel_6.6.119.3-3) (Red Hat CVE, Feedly). As a workaround where patching is not immediately possible, restrict access to parent directories of sensitive special files (e.g., tighten permissions on /dev) and enforce security policies limiting use of inotify/fanotify by unprivileged users.

The vulnerability was acknowledged by Red Hat and assigned a Medium severity rating. Multiple Linux distributions including Debian, Ubuntu, SUSE, Amazon Linux, and Microsoft Azure Linux have issued security advisories and patches. The fix references an academic paper on file-notification side-channel attacks, indicating the issue has been studied in the security research community (Red Hat CVE, Feedly). No notable social media controversy or high-profile researcher commentary has been observed.