The vulnerability allows a local, unprivileged user to interfere with a root‑run daemon by creating a symlink at the daemon’s fixed pidfile location. The daemon fails to use the O_NOFOLLOW flag and does not validate the opened file with fstat() before writing, so it writes into whatever file the symlink points to. An attacker can therefore cause the daemon to write to an arbitrary root‑owned file of their choice, an operation that would normally be disallowed at the user level. This provides the attacker direct write privileges to root files and can lead to configuration tampering or compromise of system integrity.

All Linux kernel builds that contain the older implementation of the intel-speed-select daemon are affected. No specific vendor or kernel version is listed, so all distributions using the affected kernel before the patch are impacted.

The attack requires no special privileges beyond the ability to create a symlink in the daemon’s pidfile directory, which is typically /tmp and writable by all users. Because the daemon runs as root, the local user gains the ability to modify any file the daemon can access, which is a significant escalation. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The practical risk is high for systems where the daemon is running as root and the pidfile directory is world‑writable.