Technology Miraj Islam September 27, 2026 0 Comments

‘Decades-old’ bugs found affecting Windows, Android, macOS and Linux, but OS makers don’t see it as a big deal

Researchers at the University of Graz found decades-old flaws in file notification subsystems in Linux, Windows, macOS and Android
Side-channel attacks can infer keystrokes, websites visited, or even steal credentials through unprivileged access.
Linux submitted partial mitigations (CVE‑2025‑68788); Microsoft and Apple acknowledged this but did not implement the patch; Demonstration expected at ACM CCS 2026

Researchers have found a vulnerability in all major operating systems that could, in certain scenarios, allow threat actors to steal login credentials or track which websites the target is visiting. Operating system manufacturers, on the other hand, don’t seem too far ahead in this regard.

The bug is described as a side-channel attack, a type of attack in which threat actors simply observe how the system works and extract valuable secrets through indirect clues. For example, by monitoring how much power the chip consumes at any given time, attackers can observe and extract passwords.

It was discovered by security researchers from the Graz University of Technology in Austria: Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss.

Notify the system

This particular side channel vulnerability was found in the file notification subsystem that runs on virtually every operating system that exists today. The subsystem is designed to notify applications when files on a system change. Not what has changed, just that a change occurred. The bug is supposed to be quite old as well.

“We found decades-old errors in [these operating systems]all of them based on the file notification subsystems that every modern operating system includes to inform applications when files change,” said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Registry.

On Linux, the subsystem is called inotify and has been affected since 2005. On Android it is FileObserver (affected since 2008), and on Windows, ReadDirectoryChangesW, defective since 2000. On MacOS, it is called FSEvents, vulnerable since 2007.

In the article, the researchers claim that the file’s event information can help attackers conclude what other users are doing on a computer. They can launch a keystroke attack, inferring what users enter (both locally and remotely), reveal what websites they visit, and possibly even steal login credentials through UI patching.

The problem arises from the fact that unprivileged users can access the file notification subsystem. This mainly relates to files that can be read by multiple users, but apparently there are quite a few files on a system that fall into that category.

No patch

“On Linux, looking at a readable directory leaks events into files inside it that you can’t even read: looking at /dev/input provides a notification with every keypress, which we turn into a local keystroke timing attack with 93.1-100% [keystroke accuracy] score between seven users and one remote (SSH) at 100%,” said Neela.

The percentage range means that the attack will not work in all cases, which is more or less standard for side channel attacks. They’re notoriously difficult to achieve, which is probably also why most OS makers barely batted an eye at the news.

They were all notified of the findings about a year ago, and most never bothered to address the issue. Linux introduced some mitigations, including CVE-2025-68788, which prevents inotify from raising certain “access” and “modification” events for special files. The fix has been shipped to multiple Linux kernels and distributions, but addresses only a portion of the broader attack techniques the researchers described.

Microsoft and Apple apparently acknowledged the findings, but otherwise did very little. Microsoft told researchers that the ReadDirectoryChangesW behavior was “by design,” although the feature is undocumented. They believe that the ability to monitor file paths between users is not a vulnerability worthy of a patch. The report also doesn’t mention Apple doing anything about it.