Security researchers report that Microsoft considers the side-channel leak of file events to be by design.
Security researchers affiliated with Austria's Graz University of Technology have found flaws in the implementation of file notification systems on Android, Linux, macOS, and Windows that leak potentially compromising system information.
Affected systems include inotify on Linux since 2005, FileObserver on Android since 2008, ReadDirectoryChangesW on Windows since 2000, and FSEvents on macOS since 2007.
Neela and colleagues Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss describe their findings in a paper titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS."
The paper, summarized at inoti.fyi, says the basic problem is that unprivileged users can access the file notification subsystem and that on Linux and Windows file information is available even without read access.
The attack scenarios mostly involve a local attacker who has access to an account with files that can be read by multiple users.
The Linux vulnerability was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3.
Though the researchers claim that they responsibly disclosed their findings to security teams for Linux, Android, Windows, and macOS between August and October 2025, no mitigation appears to have been made for Android devices.
The researchers' paper is scheduled to appear at ACM CCS 2026 this November in The Hague, Netherlands.