CVE-2026-80663 tools/power/x86/intel-speed-select: Harden daemon pidfile open
A local attacker can exploit a symlink vulnerability in the intel-speed-select daemon to overwrite arbitrary files with root privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80663?
CVE-2026-80663 is a high-severity path traversal vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tools/power/x86/intel-speed-select: Harden daemon pidfile open
Avoid symlink-based pidfile clobbering by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing.
The daemon currently uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file.
Which versions are affected by CVE-2026-80663?
Linux distribution packages (4)
cpupower SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 6.4.0-150700.9.6.2 |
cpupower SUSE:Linux Enterprise Server 16.0 | All versions | 6.12.0-160000.3.1 |
cpupower SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 6.12.0-160000.3.1 |
cpupower openSUSE:Leap 16.0 | All versions | 6.12.0-160000.3.1 |
How do I fix CVE-2026-80663?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-80663 being exploited?
There is no known exploitation of CVE-2026-80663 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80663, DEBIAN-CVE-2026-80663, GHSA-3m25-qfr7-c9r2, SUSE-SU-2026:24362-1, SUSE-SU-2026:4890-1, UBUNTU-CVE-2026-80663 and 1 more.