CVE-2025-68788 fsnotify: do not generate ACCESS/MODIFY events on child for special files

Not scored Published 13 Jan 2026 Updated 19 Oct 2026

Local attackers can infer access to special files via fsnotify events, bypassing read restrictions and enabling information exfiltration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-68788?

CVE-2025-68788 is a vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: do not generate ACCESS/MODIFY events on child for special files

inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev).

Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change.

The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat().

Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1].

[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf

Weakness: CWE-200

Which versions are affected by CVE-2025-68788?

How do I fix CVE-2025-68788?

Apply the vendor's patch.

Is CVE-2025-68788 being exploited?

There is no known exploitation of CVE-2025-68788 in the wild and no public exploit code.

Sources

Also known as AZL-74447, BELL-CVE-2025-68788, DEBIAN-CVE-2025-68788, GHSA-hgq3-chg9-c98j, ROOT-OS-UBUNTU-2204-CVE-2025-68788, ROOT-OS-UBUNTU-2404-CVE-2025-68788 and 1 more.