CVE-2025-68788: In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotif...

Description

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev). Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change. The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat(). Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1]. [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf

Metrics

EPSS Probability

0.17%

6.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 72acc854427948efed7a83da27f7dc3239ac9afc, < df2711544b050aba703e6da418c53c7dc5d443ca; >= 72acc854427948efed7a83da27f7dc3239ac9afc, < 859bdf438f01d9aa7f84b09c1202d548c7cad9e8; >= 72acc854427948efed7a83da27f7dc3239ac9afc, < 6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91; >= 72acc854427948efed7a83da27f7dc3239ac9afc, < e0643d46759db8b84c0504a676043e5e341b6c81; >= 72acc854427948efed7a83da27f7dc3239ac9afc, < 82f7416bcbd951549e758d15fc1a96a5afc2e900; >= 72acc854427948efed7a83da27f7dc3239ac9afc, < 7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6; >= 72acc854427948efed7a83da27f7dc3239ac9afc, < 635bc4def026a24e071436f4f356ea08c0eed6ff
Linux	Linux	2.6.36

References

Timeline

Published: Jan 13, 2026
Last Modified: Jul 14, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2025-68788?

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev). Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change. The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat(). Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1]. [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf

How severe is CVE-2025-68788?

Severity scoring for CVE-2025-68788 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.

How do I fix CVE-2025-68788?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →