CVE-2026-80663 Linux CVE debrief

Who should care

System administrators and users of Linux systems with the intel-speed-select tool installed should be aware of this vulnerability and take steps to mitigate it. This includes verifying and applying vendor-provided patches or updates, restricting access to the intel-speed-select tool, and monitoring system logs for suspicious activity. The vulnerability has a high CVSS score of 7.1 and is considered a high priority due to the local attack vector and potential for privilege escalation. The CVE record was published on 2026-08-28T08:16:51.503Z and has not been modified since then. The intel-speed-select tool is used in Linux systems and the vulnerability allows a local unprivileged user to clobber a pidfile and write to an attacker-chosen file. The vulnerability has been resolved by hardening the daemon pidfile open with O_NOFOLLOW and validating it with fstat() before locking/writing. The NVD provides official details on the vulnerability, including its CVSS score and severity. The CVE Program also provides official records of the vulnerability. Further verification is needed to determine the full scope of affected systems and potential mitigations. The vulnerability is considered a high priority due to the local attack vector and potential for privilege escalation. The Linux kernel has been updated to resolve the vulnerability. The CVE record has not been modified since its publication on 2026-08-28T08:16:51.503Z. The NVD and CVE Program provide official information on the vulnerability. The vulnerability allows a local unprivileged user to clobber a pidfile and write to an attacker-chosen file. The intel-speed-select tool is affected by the vulnerability. The vulnerability has been resolved by hardening the daemon pidfile open. System administrators and users of Linux systems with the intel-speed-select tool installed should take steps to mitigate the vulnerability. This includes verifying and applying vendor-provided patches or updates, restricting access to the intel-speed-select tool, and monitoring system logs for suspicious activity. The vulnerability is considered a high priority due to the local attack vector and potential for privilege escalation. The CVE

Technical summary

The intel-speed-select tool in the Linux kernel has a vulnerability that allows a local unprivileged user to clobber a pidfile and write to an attacker-chosen file. This is achieved by opening the pidfile with O_NOFOLLOW and validating it with fstat() before locking/writing. The vulnerability has been resolved by hardening the daemon pidfile open. The CVE record was published on 2026-08-28T08:16:51.503Z and has not been modified since then.

Defensive priority

High priority due to local attack vector and potential for privilege escalation.

Recommended defensive actions

• Verify and apply vendor-provided patches or updates
• Restrict access to the intel-speed-select tool
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this CVE is limited, but the CVE Program and NVD provide official records of the vulnerability. Further verification is needed to determine the full scope of affected systems and potential mitigations. The intel-speed-select tool in the Linux kernel has a vulnerability that allows a local unprivileged user to clobber a pidfile and write to an attacker-chosen file. This vulnerability has been resolved by hardening the daemon pidfile open with O_NOFOLLOW and validating it with fstat() before locking/writing. System administrators and users of Linux systems with the intel-speed-select tool installed should be aware of this vulnerability and take steps to mitigate it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.