Executive brief
The Linux kernel's intel-speed-select daemon is a system utility that manages Intel processor power and performance settings, typically run with elevated privileges. A local unprivileged user can exploit insecure pidfile handling to cause the daemon to write into an attacker-chosen file by creating a symlink at the pidfile path, leading to arbitrary file write and potential privilege escalation or system compromise.
Technical details
This is a symlink-based file clobbering vulnerability (CWE-59: Improper Link Resolution Before File Access) in the intel-speed-select daemon component of the Linux kernel's tools/power/x86 directory. The daemon uses a fixed pidfile path under /tmp without validating that the path is a regular file before writing; a local unprivileged attacker can pre-create a symlink at that location to redirect writes to any file writable by the daemon (typically owned by root). The fix adds the O_NOFOLLOW flag when opening the pidfile and validates the opened file with fstat() to ensure it is a regular file before locking and writing. This vulnerability requires local system access but no special privileges to exploit; the fix is available in upstream kernel commits and should be applied to all affected distributions.
Affected products
- Linux Linux kernel All versions prior to the fix commit 607af438e6430893a822964c841a1994b33acccc
Timeline
- 2026-08-28: disclosed: CVE-2026-80663 published
- 2026-06-02: patched: Fix merged upstream (commit 607af438e6430893a822964c841a1994b33acccc)
- 2026-04-26: other: Initial fix commit submitted (commit 19ffeb30fdfce63f8d6aca71bcdddb3f69d46278)