CVE-2026-80663

The intel-speed-select tool shipped with the Linux kernel (tools/power/x86/intel-speed-select) opens its daemon pidfile at a fixed path under /tmp without the O_NOFOLLOW flag or fstat() validation, so the open follows an attacker-controlled symlink. A local unprivileged user who pre-creates a symlink at that fixed path can cause a root-run daemon instance to lock and write the pidfile through the symlink, clobbering an attacker-chosen file with root-privileged writes. The impact is high integrity and availability damage to arbitrary files (CVSS 3.1: 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), though no privilege escalation is described. Only systems running the intel-speed-select daemon as root on Intel Speed Select-capable platforms are affected; this is a niche userspace tool packaged with kernel 'tools' packages, not a flaw in the running kernel itself. There is no known public proof of concept, the issue is not in CISA KEV, and EPSS estimates a ~0.1% probability of exploitation within 30 days.

What to do: Update the intel-speed-select tool via your distribution's kernel-tools/linux-tools packages once a build containing the hardened pidfile handling (O_NOFOLLOW plus fstat() validation) is available; no specific fixed version numbers are provided in this data. As interim mitigations, avoid running the intel-speed-select daemon as root, or verify the default /tmp pidfile path contains no unprivileged user-controlled symlinks before starting the daemon. Prioritize auditing servers where the daemon is known to run as root, since exploitation requires local shell access on such systems.