CVE-2026-91205 — cockpit-files: local attacker can hijack file ownership via a symlink race

cockpit-files contains a race condition during directory creation with owner assignment. A local unprivileged attacker may exploit it to redirect an ownership change to an arbitrary file, potentially causing information disclosure or unauthorized modification of sensitive files.