Local root escalation via symlink directory races

Local privilege escalation in PCP on Red Hat Enterprise Linux 8 and 9 allows local users with pcp access to gain root privileges. Privileged PCP systemd services access files beneath pcp-owned /var/lib/pcp/tmp and /var/log/pcp directory trees without safely excluding attacker-controlled symlinks. Exploitation requires local access as the low-privileged pcp account and can cross the service boundary to perform actions with root authority.