CVE-2026-80663

tools/power/x86/intel-speed-select: Harden daemon pidfile open

State: Published
Severity: 7.1 High
Published: Aug 28, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tools/power/x86/intel-speed-select: Harden daemon pidfile open

Avoid symlink-based pidfile clobbering by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing.

The daemon currently uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 905493a6338c82a70da16f86e0a6215db5a3d73dAffected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before db938eb9a3c1317596c28e94413b33426508d51bAffected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 72a07abc6b9046f07a08bba353cad7667bcc9dceAffected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 19ffeb30fdfce63f8d6aca71bcdddb3f69d46278Affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before e8adac69d1bdf035ef97cc914e845acd4ef08e28Affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 607af438e6430893a822964c841a1994b33accccAffected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 905493a6338c82a70da16f86e0a6215db5a3d73dAffected
7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before db938eb9a3c1317596c28e94413b33426508d51bAffected
7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 72a07abc6b9046f07a08bba353cad7667bcc9dceAffected
7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 19ffeb30fdfce63f8d6aca71bcdddb3f69d46278Affected
7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before e8adac69d1bdf035ef97cc914e845acd4ef08e28Affected
7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 to before 607af438e6430893a822964c841a1994b33accccAffected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.