CVE-2026-80663

What it actually does

The vulnerability is a symlink-based path traversal in the intel-speed-select daemon's pidfile handling: it opens a fixed path under /tmp without O_NOFOLLOW, allowing a local unprivileged attacker to cause the root daemon to follow a pre-created symlink and write attacker-chosen content into an arbitrary file.

Why it matters to the business

Successful exploitation can result in arbitrary file overwrites on Linux systems, potentially causing data corruption, service outages, or further system compromise when critical configuration or log files are targeted; low EPSS and absence from KEV indicate limited observed real-world abuse so far.

How an attack unfolds

An attacker with local access pre-creates a symlink at the daemon's hardcoded /tmp pidfile location pointing to a chosen target file; when the root-privileged daemon later starts and opens/writes the pidfile, the write is redirected through the symlink, clobbering the target.

How to fix it

Apply the upstream kernel fix that opens the pidfile with O_NOFOLLOW and validates it via fstat() before locking or writing; update to a Linux kernel containing the resolution once released in distribution packages.

How to confirm the fix worked

Inspect the tools/power/x86/intel-speed-select source for O_NOFOLLOW usage on pidfile open and subsequent fstat() checks; verify that no world-writable symlinks can be placed at the daemon's pidfile path and test daemon startup under controlled conditions.

Typical attack path

1. Locate or infer the fixed pidfile path used by the intel-speed-select daemon under /tmp
2. Create a symlink at that path pointing to a file the attacker wishes to modify
3. Trigger or wait for execution of the root-run daemon instance
4. Daemon performs open/write operations that follow the symlink and alter the target file

How to detect it

Review system logs and audit trails for the intel-speed-select daemon opening or writing through unexpected paths; inspect /tmp for suspicious symlinks created around daemon execution times and correlate with file modification timestamps on sensitive targets.

What your security team should do

• Track and apply Linux kernel updates containing the pidfile hardening as soon as available
• Audit and restrict permissions on /tmp to reduce symlink creation opportunities by unprivileged users
• Monitor privileged processes writing to unexpected locations and review daemon startup scripts