LACT v0.10.1 lands with two CVE patches and a handful of GPU control improvements
The open-source Linux GPU utility adds extra clock domains, Intel Xe fan tuning, and tightens its polkit authentication ahead of the autumn update cycle.
Linux GPU tinkerers have a reason to update this week. LACT v0.10.1 dropped today, and while the maintainer calls it "primarily a bugfix release," it quietly patches two security vulnerabilities that matter given how much root access the daemon wields.
If you're running Linux and want a single pane of glass for AMD, NVIDIA, and Intel GPUs, LACT has quietly become the default. Written in Rust, it tracks over 5,500 stars on GitHub, and the project just closed out a two-week sprint between the August 12 feature release and this hotfix. On top of the security work, you'll find extra clock domain reporting, cleaner GPU naming in the UI, and a new voltage/frequency curve storage method for Nvidia cards.
Tightening the privilege boundary
The headline work here is actually under the hood. The lactd service runs with root privileges to talk directly to kernel GPU interfaces, which means any authentication flaw gets amplified. CVE-2026-75037 slipped through the polkit check by trusting the process PID instead of pulling the UID directly from the Unix socket credentials. A local attacker could theoretically spoof a matching PID to bypass the polkit prompt. The fix routes authentication straight through socket credentials and leans on pidfd where the kernel supports it.
Then there's CVE-2026-75038, a symlink-following bug that turned debug snapshot creation into a potential local denial of service. Someone could point a symlink at /etc/shadow or /var/log/syslog and watch the daemon happily write over it. The release forces new file creation without following existing symlinks. Both vulnerabilities were disclosed through SUSE's Bugzilla on August 25, four days before the patch hit, and both carry CVSS scores in the high to moderate range.
Keep in mind that if you're on Flatpak, this update isn't optional. The daemon runs outside the sandbox with full root access, so trust boundary hardening is essentially a prerequisite for running the tool unattended. The polkit improvements directly address that exact friction point.
What actually changes for users
Beyond the security work, the feature set grows just enough to notice. Extra clock domains now report their own frequencies alongside GPU and VRAM clocks on both AMD and Nvidia cards. It's a minor detail, but it saves you from flipping between lactd logs and the main window when you're chasing instability. Nvidia users get VF curves stored as offsets instead of absolute values now. Existing curves will migrate automatically, though the release notes explicitly warn you to double-check them since driver base curves shift over time. AMD APU owners should see clock controls finally reach more of the Accelerated Processing Units that previously fell through the cracks.
The most buzzworthy addition is Intel Xe fan control. It's limited to Battlemage cards and still needs a patched Linux kernel. The maintainer links to the upstream patch series on Patchwork, which means you're likely compiling a custom kernel or using a distribution that's already picked it up. Development hit a snag along the way: reading the intel_pmt sysfs interface crashed kernels 7.1.5 through 7.2-rc5, forcing a workaround that simply skips the interface in test snapshots. Not ideal, but it shows the project is actively wrestling with upstream gaps rather than waiting for them to be patched.
You can grab v0.10.1 from the usual channels. Arch users pull it via pacman, Fedora runs it from Copr, and Debian or Ubuntu users grab the .deb packages from the releases page. The project also ships official packages for Gentoo, OpenSUSE Tumbleweed, NixOS, and Solus. Source builds work with make && sudo make install, though you'll need Rust 1.97 or newer.
It's a solid hotfix cycle. The security patches are exactly the kind of unglamorous work that keeps root-privileged Linux tools from becoming liability liabilities. The extra clock domain reporting and cleaner GPU names feel like quality-of-life polish rather than headline features, but they add up. LACT keeps proving that multi-vendor GPU management on Linux doesn't require jumping between Qt-based utilities and terminal commands anymore. Just keep an eye on that Intel Xe fan patch series if you're running Battlemage. Until upstream ships it, you'll be compiling.
The release notes include a full list of translator and contributor credits, and if you want to track ongoing kernel patch status for Intel Xe fan control, the maintainer keeps it pinned to the project's patchwork page.
Head here to grab v0.10.1 if you haven't already.
