CVE-2026-16552 Systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a chase_safe root-to-unprivileged ownership transition bypass

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away...