The shmem_nopage function in shmem.c for the tmpfs driver in Linux kernel 2.6 does not properly verify the address argument, which allows local users to cause a denial of service (kernel crash) via an invalid address.
- http://www.redhat.com/support/errata/RHSA-2005-366.html
No PoCs found on GitHub currently.