CVE-2025-68788

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: do not generate ACCESS/MODIFY events on child for special files

inotify/fanotify do not allow users with no read access to a file to

subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the

same user to subscribe for watching events on children when the user

has access to the parent directory (e.g. /dev).

Users with no read access to a file but with read access to its parent

directory can still stat the file and see if it was accessed/modified

via atime/mtime change.

The same is not true for special files (e.g. /dev/null). Users will not

generally observe atime/mtime changes when other users read/write to

special files, only when someone sets atime/mtime via utimensat().

Align fsnotify events with this stat behavior and do not generate

ACCESS/MODIFY events to parent watchers on read/write of special files.

The events are still generated to parent watchers on utimensat(). This

closes some sid

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References