A vulnerability in the Linux kernel intel-speed-select daemon permits local privilege escalation or file corruption by leveraging insecure pidfile handling.

The intel-speed-select daemon utilizes a hardcoded path in /tmp for its pidfile, which is susceptible to a symlink race condition. A local unprivileged user can create a malicious symlink at this location, causing the root-privileged daemon to overwrite sensitive system files during initialization.

Successful exploitation allows a local attacker to achieve elevated file write capabilities, potentially leading to full system compromise or denial of service by corrupting critical configuration files. While the CVSS score of 7.1 reflects a high severity based on the ability to impact system integrity and availability, the requirement for local access limits the attack surface to users already present on the host.

Immediate Action: Update the Linux kernel to version 6.1.178, 6.6.145, 6.12.97, 6.18.40, or a later stable release to incorporate the hardened pidfile handling.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or modify files within the /tmp directory or unexpected daemon behavior during startup.

Compensating Controls: Restrict access to the intel-speed-select utility for non-administrative users and ensure that temporary directory permissions are strictly enforced to prevent unauthorized symlink creation.

Public Exploit Available: No

System administrators should prioritize patching the Linux kernel to the identified secure versions to prevent local privilege escalation. Given that this vulnerability permits arbitrary file writes as root, it represents a significant security risk to multi-user environments and should be addressed during the next scheduled maintenance window.