CVE-2026-80663: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80663 Overview

CVE-2026-80663 affects the intel-speed-select daemon shipped with the Linux kernel source tree under tools/power/x86/. The daemon writes its pidfile to a fixed path in /tmp without protection against symbolic link attacks. A local unprivileged user can pre-create a symlink at the pidfile path and redirect the root-run daemon to write into an attacker-chosen file. The upstream fix opens the pidfile with O_NOFOLLOW and validates the descriptor with fstat() before locking and writing. This is a classic symlink-following flaw ([CWE-59]) that impacts file integrity and availability on affected hosts.

Critical Impact
A local unprivileged user can leverage a predictable pidfile path in /tmp to overwrite arbitrary files owned by root, resulting in file corruption or denial of service on systems running the intel-speed-select daemon.

Affected Products

Linux kernel tools/power/x86/intel-speed-select daemon utility
Distributions packaging intel-speed-select from affected kernel trees
Intel x86 systems running the Speed Select daemon as root

Discovery Timeline

2026-08-28 - CVE-2026-80663 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80663

Vulnerability Analysis

The intel-speed-select utility runs a daemon component that manages Intel Speed Select Technology configuration. On startup the daemon opens a pidfile at a fixed, world-writable location under /tmp and writes its process ID after acquiring a lock. The original implementation used a standard open() call without O_NOFOLLOW and did not validate the resolved file object before writing.

The attack is a symlink-based file clobbering primitive. An unprivileged local user predicts or observes the pidfile path and creates a symbolic link there pointing to a sensitive file such as /etc/shadow, a systemd unit, or a critical configuration file. When the root-run daemon starts, open() follows the symlink and truncates or overwrites the target with the daemon's PID string.

Root Cause

The root cause is missing symlink protection during pidfile creation combined with a predictable path in a shared directory. The daemon trusted the pathname resolution result without verifying that the opened descriptor referred to a regular file owned by the expected user. No O_NOFOLLOW flag was set, and no post-open fstat() validation was performed.

Attack Vector

Exploitation requires local access with an unprivileged shell on the target host. The attacker races or pre-positions a symlink at the daemon's pidfile path before the daemon starts. When the daemon subsequently runs with root privileges, the write operation follows the symlink and clobbers the linked target. The attacker does not need to interact with the daemon further, and no user interaction is required beyond planting the symlink.

The vulnerability is described in the referenced kernel commits. See the Kernel Git Commit #e8adac6 and Kernel Git Commit #905493a for the upstream fix that adds O_NOFOLLOW and fstat() validation.

Detection Methods for CVE-2026-80663

Indicators of Compromise

Unexpected symbolic links present in /tmp pointing to system files such as /etc/shadow, /etc/passwd, or systemd unit files.
System files containing only a numeric PID value where structured content is expected.
Audit records showing the intel-speed-select daemon opening files outside /tmp shortly after service start.

Detection Strategies

Enable Linux audit rules on open(), openat(), and symlink() syscalls invoked by the intel-speed-select binary and alert on writes outside /tmp.
Monitor for symlink creation events in world-writable directories by non-privileged users, correlated with service startup events.
Compare file integrity baselines for critical configuration files after each intel-speed-select service restart.

Monitoring Recommendations

Alert on service restarts of intel-speed-select correlated with recent file modifications in /etc or /lib/systemd.
Track processes running as root that open files whose parent directory is world-writable and whose owner does not match the effective UID.
Log and review any use of intel-speed-select daemon mode in production environments where it is not required.

How to Mitigate CVE-2026-80663

Immediate Actions Required

Apply the upstream kernel-tools patches referenced below to add O_NOFOLLOW and fstat() validation to the pidfile open path.
Stop or disable the intel-speed-select daemon on systems where Speed Select configuration is not actively managed.
Restrict shell access on multi-user systems and enforce the sticky bit on /tmp to reduce local attacker leverage.

Patch Information

The fix is committed across multiple stable branches. See Kernel Git Commit #19ffeb3, Kernel Git Commit #607af43, Kernel Git Commit #72a07ab, Kernel Git Commit #905493a, Kernel Git Commit #db938eb, and Kernel Git Commit #e8adac6. Rebuild intel-speed-select from a patched kernel tree or install the vendor-provided package update.

Workarounds

Relocate the pidfile to a root-owned directory such as /run/intel-speed-select/ with mode 0755 prior to starting the daemon.
Ensure /tmp is mounted with the sticky bit set so unprivileged users cannot delete or replace files owned by other users.
Disable the daemon entirely on systems that do not require dynamic Speed Select tuning.

bash

# Create a protected runtime directory for the pidfile
sudo install -d -o root -g root -m 0755 /run/intel-speed-select

# Verify /tmp has the sticky bit set
stat -c '%A %n' /tmp
# Expected output includes trailing 't', e.g. drwxrwxrwt /tmp

# Disable the service if not required
sudo systemctl disable --now intel-speed-select.service