EIP-2026-103003

This exploit leverages a symbolic link vulnerability in makebootdisk, which insecuresly creates /tmp/return and follows symlinks. An attacker can overwrite arbitrary files (e.g., /etc/passwd) by creating a symlink and waiting for root to execute the program.