CVE-2026-73585 describes an insecure temporary file creation vulnerability in the sblim-cmpi-base provider registration scripts. A local unprivileged attacker can exploit this by creating symbolic links in world-writable directories such as /tmp or /var/tmp. When the provider registration scripts run with elevated privileges, they may follow these symlinks and overwrite arbitrary root-owned files. This can disrupt system services or operations. The vulnerability requires specific conditions including privileged script execution and lack of sticky-directory symlink protections, which mitigate the risk. Red Hat's advisory recommends enabling the kernel parameter fs.protected_symlinks=1 to enforce symlink protections and advises avoiding running these scripts in shared environments where untrusted users can create symlinks.

The vulnerability allows a local unprivileged user to overwrite root-owned files by exploiting insecure temporary file creation in privileged scripts. This can lead to disruption of system services or operations. The impact is limited by the need for the script to run with elevated privileges and the presence of sticky-directory symlink protections. There is no confidentiality impact, but integrity and availability impacts are high.

Red Hat advises enabling sticky-directory symlink protections immediately by running `sysctl -w fs.protected_symlinks=1` and making this change persistent by adding `fs.protected_symlinks=1` to a file in `/etc/sysctl.d/` and applying it with `sysctl --system`. Additionally, avoid running the sblim-cmpi-base provider registration scripts in shared multi-user systems where untrusted users can create symlinks in world-writable temporary directories like /tmp or /var/tmp. If manual execution is necessary, use a private, root-owned temporary directory. No official patch is currently indicated; mitigation relies on configuration and operational practices.