CVE-2025-68788

What it actually does

The kernel's fsnotify layer generated ACCESS/MODIFY events for child special files (e.g. /dev/null) to inotify/fanotify watchers who only had read access to the parent directory, even when they lacked read permission on the file itself; this allowed observation of atime/mtime changes that would not normally be visible via stat.

Why it matters to the business

Organizations running affected kernels face a low-severity information-disclosure risk that could be used for side-channel inference of activity on device files; the issue is not known to be exploited in the wild and carries minimal operational urgency.

How an attack unfolds

An attacker with read access to a directory containing special files but no read access to those files subscribes to IN_ACCESS/IN_MODIFY events on the directory; when other processes read or write the special files the attacker receives events that would otherwise be invisible, enabling inference of usage patterns.

How to fix it

Upgrade the Linux kernel to a version containing commit df2711544b050aba703e6da418c53c7dc5d443ca or later; rebuild and reboot all affected systems; no configuration changes are required after the update.

How to confirm the fix worked

Confirm the running kernel contains commit df2711544b050aba703e6da418c53c7dc5d443ca by inspecting /proc/version or the kernel build log; attempt to reproduce the prior behavior with a non-privileged watcher on a directory containing a special file and verify that ACCESS/MODIFY events are no longer delivered.

Typical attack path

1. Obtain read access to a parent directory that contains special files such as device nodes.
2. Register an inotify or fanotify watch on the directory requesting child ACCESS/MODIFY events.
3. Wait for other processes to perform read/write operations on the watched special files.
4. Receive and correlate the resulting events to infer timing or existence of activity on the files.

How to detect it

Search kernel audit logs, inotify event streams, and fanotify records for unexpected child ACCESS/MODIFY notifications on directories containing device nodes; correlate with user namespaces or container boundaries where directory watches were granted without file-level read permission.

What your security team should do

• Prioritize kernel updates on any systems exposing /dev or similar directories to untrusted users.
• Monitor upstream stable kernel releases for the referenced commit and schedule rollout within normal patching cycles.
• Review inotify/fanotify usage in security-monitoring tools to ensure they do not rely on the removed event behavior.