rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode) (CVE-2026-35349) | HOL Guard CVE