Local privilege escalation via path-based chmod race

TOCTOU in the mkfifo utility in uutils coreutils allows local users to change arbitrary file permissions through a symlink race. The utility creates a FIFO, then std::fs::set_permissions follows the pathname, allowing a directory writer to replace the FIFO with a symlink before chmod. Exploitation requires write access to the parent directory and a privileged invocation; success changes permissions on the symlink target and enables privilege escalation.