Root privilege escalation via symlink-check race

A TOCTOU race in RPM Package Manager before 4.18.0 allows local users to gain root privileges during privileged package installation. RPM calls lstat() to approve a directory symlink, then opens the destination path without binding file creation to the checked directory, allowing the symlink target to be exchanged between operations. Exploitation requires control of RPM installation artifacts and winning a narrow timing window while a privileged transaction creates files.