A vulnerability exists in the ansible-core user module when the generate_ssh_key option is enabled. The module attempts to protect key files against symlinks but only checks the ~/.ssh directory with os.path.exists(), allowing an unprivileged user to replace ~/.ssh with a symlink to a root-writable directory. This causes the privileged module to write SSH key files through the symlink and change ownership to the user, potentially enabling local privilege escalation to root via files placed in directories processed by schedulers or dynamic MOTD. This is an incomplete fix of a previous vulnerability (CVE-2024-9902).