Linux kernel before 2.6.13 allows local users to cause a denial of service (crash) via a dio transfer from the sg driver to memory mapped (mmap) IO space.
- http://linux.bkbits.net:8080/linux-2.6/cset%4043220081yu9ClBQNuqSSnW_9amW7iQ
No PoCs found on GitHub currently.