--- title: Research into file-notification attacks on Linux | daily.dev description: Researchers from Graz University of Technology disclosed file-notification attacks affecting Android, Linux, macOS, and Windows. On Linux, inotifywatch can be... canonical: https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Research into file-notification attacks on Linux | daily.dev og:description: Researchers from Graz University of Technology disclosed file-notification attacks affecting Android, Linux, macOS, and Windows. On Linux, inotifywatch can be... og:url: https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw og:image: https://api.daily.dev/og/posts/OzDeFmAvw.png og:image:alt: Research into file-notification attacks on Linux og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Research into file-notification attacks on Linux **[LWN.net](https://daily.dev/sources/lwn)** · 2 min read · 0 upvotes · 0 comments ## Summary Researchers from Graz University of Technology disclosed file-notification attacks affecting Android, Linux, macOS, and Windows. On Linux, inotifywatch can be used to conduct an inter-keystroke timing attack on a directory without needing read access to its files. The team also found a UI-redress (clickjacking) technique on KDE 5 and 6, monitoring /usr/bin/pkexec to detect when Polkit spawns an authentication prompt, letting an attacker overlay a fake password window to steal credentials. Both flaws remain present, though the Linux kernel partially mitigated the issue with a fix included in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65, and 6.18.3 released in January. A paper and demonstration site provide more details and a workaround to stop password prompts from losing focus. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which Linux kernel versions fixed the inotify-based file-notification vulnerability? A partial mitigation was included in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65, and 6.18.3, released in January. The fix addresses part of an inter-keystroke timing attack that lets an attacker use inotifywatch to monitor a directory and infer user activity even without read access to the files inside it. The underlying issue is tracked as CVE-2025-68788. _Teams tracking kernel CVEs and patch timelines can follow security fixes like this on daily.dev._ ### How can an attacker use inotify to spy on keystrokes without file read access on Linux? An attacker monitors a directory with inotifywatch and performs an inter-keystroke timing attack, inferring typing patterns from the timing of file-system notification events, without needing read permission on the files themselves. This was demonstrated by researchers from Graz University of Technology alongside a related UI-redress attack on KDE that spoofs Polkit authentication prompts. _Developers auditing Linux desktop security risks can keep up with findings like this on daily.dev._ ### How does the KDE Polkit clickjacking attack trick users into revealing their password? An attacker monitors /usr/bin/pkexec to detect the moment Polkit spawns an authentication prompt, then draws a fake password window on top of the real one to capture the user's credentials, a UI-redress or clickjacking technique demonstrated on both KDE 5 and KDE 6. A mitigation exists to prevent password-prompt windows from losing focus, reducing the attack's effectiveness. _Linux desktop maintainers weighing UI-redress risks can track disclosures like this on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Research into file-notification attacks on Linux","url":"https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw"},"datePublished":"2026-09-24T17:44:23.962Z","dateModified":"2026-09-25T18:03:54.273Z","description":"Researchers from Graz University of Technology disclosed file-notification attacks affecting Android, Linux, macOS, and Windows. On Linux, inotifywatch can be...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"LWN.net","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LWN.net","logo":"https://media.daily.dev/image/upload/s--4jjE7GIK--/f_auto,q_auto/v1774960833/logos/lwn?_a=BAMAMiWQ0","url":"https://daily.dev/sources/lwn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LWN.net","item":"https://daily.dev/sources/lwn"},{"@type":"ListItem","position":3,"name":"Research into file-notification attacks on Linux"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/research-into-file-notification-attacks-on-linux-ozdefmavw#faq","mainEntity":[{"@type":"Question","name":"Which Linux kernel versions fixed the inotify-based file-notification vulnerability?","acceptedAnswer":{"@type":"Answer","text":"A partial mitigation was included in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65, and 6.18.3, released in January. The fix addresses part of an inter-keystroke timing attack that lets an attacker use inotifywatch to monitor a directory and infer user activity even without read access to the files inside it. The underlying issue is tracked as CVE-2025-68788. Teams tracking kernel CVEs and patch timelines can follow security fixes like this on daily.dev."}},{"@type":"Question","name":"How can an attacker use inotify to spy on keystrokes without file read access on Linux?","acceptedAnswer":{"@type":"Answer","text":"An attacker monitors a directory with inotifywatch and performs an inter-keystroke timing attack, inferring typing patterns from the timing of file-system notification events, without needing read permission on the files themselves. This was demonstrated by researchers from Graz University of Technology alongside a related UI-redress attack on KDE that spoofs Polkit authentication prompts. Developers auditing Linux desktop security risks can keep up with findings like this on daily.dev."}},{"@type":"Question","name":"How does the KDE Polkit clickjacking attack trick users into revealing their password?","acceptedAnswer":{"@type":"Answer","text":"An attacker monitors /usr/bin/pkexec to detect the moment Polkit spawns an authentication prompt, then draws a fake password window on top of the real one to capture the user's credentials, a UI-redress or clickjacking technique demonstrated on both KDE 5 and KDE 6. A mitigation exists to prevent password-prompt windows from losing focus, reducing the attack's effectiveness. Linux desktop maintainers weighing UI-redress risks can track disclosures like this on daily.dev."}}]} ```