The Linux kernel’s Intel‑speed‑select daemon previously failed to secure its pidfile against symlink races. An unprivileged local user can create a symlink at the daemon’s fixed /tmp/pidfile path so that when the root‑run daemon opens the file it follows the symlink and writes to an arbitrary location chosen by the attacker. Because the daemon runs as root, the write operation is performed with full system privileges, allowing the local user to modify any root‑owned file that the daemon can reach. This leads to direct escalation of local privileges and compromise of system integrity.

Any Linux kernel that includes the unpatched Intel‑speed‑select daemon is affected. No vendor or version string is specified, meaning that distributions shipping kernels with the older implementation before the patch are impacted.

The vulnerability can be triggered by a local user who can create a symlink in /tmp, a world‑writable directory. With a CVSS score of 7.1, the flaw is classified as high severity. The EPSS score of <1% indicates that actual exploitation is currently unlikely, but the risk remains significant for systems operating the vulnerable daemon and is not present in the CISA KEV catalog.