CVE-2026-80663

A flaw was found in the Linux kernel's Intel Speed Select daemon. A local unprivileged user can exploit a symlink vulnerability in the daemon's pidfile handling. By pre-creating a symbolic link at the fixed pidfile path under /tmp, the attacker can cause the root-run daemon instance to write into an attacker-chosen file. This could lead to arbitrary file write, potentially enabling privilege escalation or denial of service.

A symlink following issue exists in the intel-speed-select daemon pidfile handling because a fixed pidfile path under /tmp was opened without O_NOFOLLOW and without verifying that the opened object is a regular file. A local unprivileged user can pre create a symlink at that path and wait for a root run daemon instance to open and write the pidfile, causing root level clobbering of an attacker chosen file. For the CVSS the PR:L is used because the attacker needs local user access to create the symlink and influence the local filesystem namespace, but does not need root privileges. The issue is not network reachable and is triggered through local filesystem state during daemon startup. Impact is mainly integrity loss from root level file overwrite and possible denial of service if a sensitive system file is corrupted. In worst case this should be treated as a possible local privilege escalation candidate because root file clobbering may be exploitable depending on the exact target file and service configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.