tools/power/x86/intel-speed-select: Harden daemon pidfile open
Summary
| CVE | CVE-2026-80663 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-28 08:16:51 UTC |
| Updated | 2026-08-29 07:16:48 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing. The daemon currently uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.001260000 probability, percentile 0.025620000 (date 2026-08-31)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 905493a6338c82a70da16f86e0a6215db5a3d73d git | Not specified |
| CNA | Linux | Linux | affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 db938eb9a3c1317596c28e94413b33426508d51b git | Not specified |
| CNA | Linux | Linux | affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 72a07abc6b9046f07a08bba353cad7667bcc9dce git | Not specified |
| CNA | Linux | Linux | affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 19ffeb30fdfce63f8d6aca71bcdddb3f69d46278 git | Not specified |
| CNA | Linux | Linux | affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 e8adac69d1bdf035ef97cc914e845acd4ef08e28 git | Not specified |
| CNA | Linux | Linux | affected 7fd786dfbd2c55ddee3b87f33c82f1c58bdb1dd6 607af438e6430893a822964c841a1994b33acccc git | Not specified |
| CNA | Linux | Linux | affected 5.18 | Not specified |
| CNA | Linux | Linux | unaffected 5.18 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.178 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.145 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.97 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.40 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.5 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/607af438e6430893a822964c841a1994b33acccc | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/72a07abc6b9046f07a08bba353cad7667bcc9dce | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e8adac69d1bdf035ef97cc914e845acd4ef08e28 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/db938eb9a3c1317596c28e94413b33426508d51b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/19ffeb30fdfce63f8d6aca71bcdddb3f69d46278 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/905493a6338c82a70da16f86e0a6215db5a3d73d | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.