GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68788 (GCVE-0-2025-68788)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-09-08 08:43
VLAI
Title
fsnotify: do not generate ACCESS/MODIFY events on child for special files
Summary
In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev). Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change. The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat(). Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1]. [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 16:22 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < df2711544b050aba703e6da418c53c7dc5d443ca (git)
Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < 859bdf438f01d9aa7f84b09c1202d548c7cad9e8 (git)
Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < 6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91 (git)
Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < e0643d46759db8b84c0504a676043e5e341b6c81 (git)
Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < 82f7416bcbd951549e758d15fc1a96a5afc2e900 (git)
Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < 7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6 (git)
Affected: 72acc854427948efed7a83da27f7dc3239ac9afc , < 635bc4def026a24e071436f4f356ea08c0eed6ff (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T16:22:25.274360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T16:22:36.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:43:30.378Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fsnotify.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df2711544b050aba703e6da418c53c7dc5d443ca",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            },
            {
              "lessThan": "859bdf438f01d9aa7f84b09c1202d548c7cad9e8",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            },
            {
              "lessThan": "6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            },
            {
              "lessThan": "e0643d46759db8b84c0504a676043e5e341b6c81",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            },
            {
              "lessThan": "82f7416bcbd951549e758d15fc1a96a5afc2e900",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            },
            {
              "lessThan": "7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            },
            {
              "lessThan": "635bc4def026a24e071436f4f356ea08c0eed6ff",
              "status": "affected",
              "version": "72acc854427948efed7a83da27f7dc3239ac9afc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fsnotify.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: do not generate ACCESS/MODIFY events on child for special files\n\ninotify/fanotify do not allow users with no read access to a file to\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\nsame user to subscribe for watching events on children when the user\nhas access to the parent directory (e.g. /dev).\n\nUsers with no read access to a file but with read access to its parent\ndirectory can still stat the file and see if it was accessed/modified\nvia atime/mtime change.\n\nThe same is not true for special files (e.g. /dev/null). Users will not\ngenerally observe atime/mtime changes when other users read/write to\nspecial files, only when someone sets atime/mtime via utimensat().\n\nAlign fsnotify events with this stat behavior and do not generate\nACCESS/MODIFY events to parent watchers on read/write of special files.\nThe events are still generated to parent watchers on utimensat(). This\ncloses some side-channels that could be possibly used for information\nexfiltration [1].\n\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:53:22.202Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df2711544b050aba703e6da418c53c7dc5d443ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/859bdf438f01d9aa7f84b09c1202d548c7cad9e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0643d46759db8b84c0504a676043e5e341b6c81"
        },
        {
          "url": "https://git.kernel.org/stable/c/82f7416bcbd951549e758d15fc1a96a5afc2e900"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/635bc4def026a24e071436f4f356ea08c0eed6ff"
        }
      ],
      "title": "fsnotify: do not generate ACCESS/MODIFY events on child for special files",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68788",
    "datePublished": "2026-01-13T15:29:01.270Z",
    "dateReserved": "2025-12-24T10:30:51.037Z",
    "dateUpdated": "2026-09-08T08:43:30.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68788",
      "date": "2026-09-16",
      "epss": "0.00208",
      "percentile": "0.11107"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68788\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:15:58.623\",\"lastModified\":\"2026-07-14T13:18:00.363\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfsnotify: do not generate ACCESS/MODIFY events on child for special files\\n\\ninotify/fanotify do not allow users with no read access to a file to\\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\\nsame user to subscribe for watching events on children when the user\\nhas access to the parent directory (e.g. /dev).\\n\\nUsers with no read access to a file but with read access to its parent\\ndirectory can still stat the file and see if it was accessed/modified\\nvia atime/mtime change.\\n\\nThe same is not true for special files (e.g. /dev/null). Users will not\\ngenerally observe atime/mtime changes when other users read/write to\\nspecial files, only when someone sets atime/mtime via utimensat().\\n\\nAlign fsnotify events with this stat behavior and do not generate\\nACCESS/MODIFY events to parent watchers on read/write of special files.\\nThe events are still generated to parent watchers on utimensat(). This\\ncloses some side-channels that could be possibly used for information\\nexfiltration [1].\\n\\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nfsnotify: no generar eventos ACCESS/MODIFY en el hijo para archivos especiales\\n\\ninotify/fanotify no permiten a los usuarios sin acceso de lectura a un archivo suscribirse a eventos (p. ej., IN_ACCESS/IN_MODIFY), pero s\u00ed permiten al mismo usuario suscribirse para observar eventos en los hijos cuando el usuario tiene acceso al directorio padre (p. ej., /dev).\\n\\nLos usuarios sin acceso de lectura a un archivo pero con acceso de lectura a su directorio padre a\u00fan pueden hacer stat al archivo y ver si fue accedido/modificado a trav\u00e9s de un cambio en atime/mtime.\\n\\nLo mismo no es cierto para archivos especiales (p. ej., /dev/null). Los usuarios generalmente no observar\u00e1n cambios en atime/mtime cuando otros usuarios leen/escriben en archivos especiales, solo cuando alguien establece atime/mtime a trav\u00e9s de utimensat().\\n\\nAlinear los eventos de fsnotify con este comportamiento de stat y no generar eventos ACCESS/MODIFY a los observadores padre en la lectura/escritura de archivos especiales. Los eventos a\u00fan se generan a los observadores padre en utimensat(). Esto cierra algunos canales laterales que podr\u00edan ser posiblemente utilizados para la exfiltraci\u00f3n de informaci\u00f3n [1].\\n\\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/notify/fsnotify.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"df2711544b050aba703e6da418c53c7dc5d443ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"859bdf438f01d9aa7f84b09c1202d548c7cad9e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"e0643d46759db8b84c0504a676043e5e341b6c81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"82f7416bcbd951549e758d15fc1a96a5afc2e900\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72acc854427948efed7a83da27f7dc3239ac9afc\",\"lessThan\":\"635bc4def026a24e071436f4f356ea08c0eed6ff\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/notify/fsnotify.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T16:22:25.274360Z\",\"id\":\"CVE-2025-68788\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/635bc4def026a24e071436f4f356ea08c0eed6ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/82f7416bcbd951549e758d15fc1a96a5afc2e900\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/859bdf438f01d9aa7f84b09c1202d548c7cad9e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/df2711544b050aba703e6da418c53c7dc5d443ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e0643d46759db8b84c0504a676043e5e341b6c81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T11:01:11+00:00",
      "cve": "CVE-2025-68788",
      "id": "CVE-2025-68788",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68788.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-09-08T08:43:30.378Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-68788\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T16:22:25.274360Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T16:22:31.614Z\"}}], \"cna\": {\"title\": \"fsnotify: do not generate ACCESS/MODIFY events on child for special files\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"df2711544b050aba703e6da418c53c7dc5d443ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"859bdf438f01d9aa7f84b09c1202d548c7cad9e8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"e0643d46759db8b84c0504a676043e5e341b6c81\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"82f7416bcbd951549e758d15fc1a96a5afc2e900\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"72acc854427948efed7a83da27f7dc3239ac9afc\", \"lessThan\": \"635bc4def026a24e071436f4f356ea08c0eed6ff\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/notify/fsnotify.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.36\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.36\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/notify/fsnotify.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/df2711544b050aba703e6da418c53c7dc5d443ca\"}, {\"url\": \"https://git.kernel.org/stable/c/859bdf438f01d9aa7f84b09c1202d548c7cad9e8\"}, {\"url\": \"https://git.kernel.org/stable/c/6a7d7d96eeeab7af2bd01afbb3d9878a11a13d91\"}, {\"url\": \"https://git.kernel.org/stable/c/e0643d46759db8b84c0504a676043e5e341b6c81\"}, {\"url\": \"https://git.kernel.org/stable/c/82f7416bcbd951549e758d15fc1a96a5afc2e900\"}, {\"url\": \"https://git.kernel.org/stable/c/7a93edb23bcf07a3aaf8b598edfc2faa8fbcc0b6\"}, {\"url\": \"https://git.kernel.org/stable/c/635bc4def026a24e071436f4f356ea08c0eed6ff\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfsnotify: do not generate ACCESS/MODIFY events on child for special files\\n\\ninotify/fanotify do not allow users with no read access to a file to\\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\\nsame user to subscribe for watching events on children when the user\\nhas access to the parent directory (e.g. /dev).\\n\\nUsers with no read access to a file but with read access to its parent\\ndirectory can still stat the file and see if it was accessed/modified\\nvia atime/mtime change.\\n\\nThe same is not true for special files (e.g. /dev/null). Users will not\\ngenerally observe atime/mtime changes when other users read/write to\\nspecial files, only when someone sets atime/mtime via utimensat().\\n\\nAlign fsnotify events with this stat behavior and do not generate\\nACCESS/MODIFY events to parent watchers on read/write of special files.\\nThe events are still generated to parent watchers on utimensat(). This\\ncloses some side-channels that could be possibly used for information\\nexfiltration [1].\\n\\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.160\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.120\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.64\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.3\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"2.6.36\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:53:22.202Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-68788\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T08:43:30.378Z\", \"dateReserved\": \"2025-12-24T10:30:51.037Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-13T15:29:01.270Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.