Local process termination via cgroup path traversal

Path traversal in systemd-oomd allows local users to terminate arbitrary local processes through the managed-OOM Varlink API. ReportManagedOOMCGroups authorizes the textual user-slice component before cg_get_path simplifies the untrusted path, allowing traversal from cgroupfs into fake control files whose cgroup.procs value selects a PID for SIGKILL. Exploitation requires a local account, a running systemd-oomd service, access to its managed-OOM socket, a writable directory visible to the service, and knowledge of the target PID; privilege escalation was not demonstrated.