Look up another CVE · open CVE-2026-80663 in the interactive tracker
CVE-2026-80663
tools/power/x86/intel-speed-select: Harden daemon pidfile open
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem tools/power. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80663 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Avoid symlink-based pidfile clobbering by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing. The daemon currently uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
tools/power/x86/intel-speed-select/isst-daemon.c
- What this is
- INTEL SPEED SELECT TECHNOLOGYMAINTAINERS section matched on tools/power/x86/intel-speed-select/ · platform-driver-x86@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- tools/power
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.18 | 6.1.178 | 905493a6338c |
| 5.18 | 6.6.145 | db938eb9a3c1 |
| 5.18 | 6.12.97 | 72a07abc6b90 |
| 5.18 | 6.18.40 | 19ffeb30fdfc |
| 5.18 | 7.1.5 | e8adac69d1bd |
| 5.18 | 7.2 | 607af438e643 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires local filesystem access to plant a symlink at the fixed /tmp/hfi-events.pid path before the root-run intel-speed-select --oob daemon calls open(); there is no network, adjacent, or physical-device code path to daemonize().
- AC:LAttack complexity, low
- The attacker fully controls symlink creation in world-writable /tmp and can leave it in place until the root daemon starts or restarts (e.g., via systemd on Sapphire Rapids datacenter hosts); no uncontrollable timing or memory-layout conditions are required.
- PR:LPrivileges required, low
- Only an unprivileged local account is needed to create the /tmp/hfi-events.pid symlink; the attacker does not need init-namespace root, CAP_SYS_ADMIN, or any capability beyond ordinary local shell access.
- UI:NUser interaction, none
- Per CVSS 3.1, administrator installation or routine execution of the vulnerable daemon is not counted as user interaction; once the root OOB service is running, the attacker needs only the pre-planted symlink with no further victim action.
- S:UScope, unchanged
- The root daemon's misdirected open/write affects host filesystem objects within the same OS security authority; this is a local root-assisted file clobber, not a VM escape, container breakout, or IOMMU boundary bypass.
- C:NConfidentiality impact, none
- The daemon only writes a short numeric PID string via write() and never reads from the opened descriptor; there is no memory corruption, out-of-bounds read, or other information-disclosure primitive.
- I:HIntegrity impact, high
- A symlink causes the root daemon's open(O_RDWR|O_CREAT) to follow into an attacker-chosen path, letting root truncate/overwrite the start of protected files (e.g., /etc/passwd, sudoers, unit files) or create new root-owned files in restricted directories.
- A:HAvailability impact, high
- Overwriting the beginning of critical configuration or authentication files with root privileges can break login, service startup, or ISST OOB management, producing system-wide denial of service beyond a single daemon crash.