Symlink Attack on Intel Speed Select Daemon Pidfile

CVE-2026-80663 is a privilege escalation vulnerability in the Linux kernel's intel-speed-select daemon that allows unprivileged local users to hijack pidfile handling through symlink manipulation. The daemon uses a fixed pidfile path in /tmp without proper validation, enabling an attacker to pre-create a symlink at that location. When the root-privileged daemon runs and opens the pidfile, it follows the symlink and writes to an attacker-controlled destination, potentially overwriting sensitive files or enabling further system compromise. This affects any system running the intel-speed-select daemon with root privileges, particularly relevant in data center and high-performance computing environments where thermal and frequency management is critical.

While Casky.ai's current skill mapping shows no direct MITRE ATT&CK correlation for this specific CVE, the underlying attack pattern maps to Privilege Escalation (T1548) and File and Directory Permissions Modification (T1548.002). Security practitioners using Casky would detect the precursor behavior through behavioral analysis of file system operations—specifically monitoring for symlink creation in /tmp directories followed by daemon process file access, or detecting unexpected file writes to non-standard locations when root processes interact with common pidfile paths. Claude's extended reasoning capability would correlate insecure file operations (open without O_NOFOLLOW, missing fstat validation) with post-exploitation artifacts, surfacing the vulnerability pattern even when MITRE technique mappings are sparse.