The io_submit_one function in fs/aio.c in the Linux kernel before 2.6.23 allows local users to cause a denial of service (NULL pointer dereference) via a crafted io_submit system call with an IOCB_FLAG_RESFD flag.
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
No PoCs found on GitHub currently.