CVE-2025-67859: Critical Auth Bypass Discovered in Popular Linux Battery Utility

CVE-2025-67859 has been identified as a critical authentication bypass in the Linux power management utility TLP, specifically affecting the new “profiles daemon” introduced in TLP version 1.9.0, which runs with root privileges and manages power settings via a D-Bus API. According to SUSE Security Team, a flaw in the Polkit authentication logic allowed a complete authentication bypass, enabling any local user to issue commands without proper authorisation.

The researchers also flagged related weaknesses that could lead to a Denial-of-Service via the “profile hold” mechanism, which lets active-session users create unlimited profile holds without admin authentication, potentially exhausting resources. The analysis notes that generated “cookies” for tracking holds could also contribute to unpredictable values, further broadening the DoS surface.

SUSE researchers reported the issues to upstream maintainers in December, with the fix restricting concurrent profile holds to a maximum of 16, and Linux users are advised to upgrade to version 1.9.1.