Some vulnerabilities have been reported in the Linux Kernel, which potentially can be exploited by malicious, local users to cause a DoS (Denial of Service).

1) An error in the auto-reap of child processes that have ptrace attached can lead to dangling ptrace references. This may be exploited by local users to cause a kernel crash.

2) The use of "printk()" in the "time_out_leases()" function in "/fs/locks.c" can consume a large amount of kernel log space. This can be exploited by local users to cause a DoS by generating a large number of broken leases.

3) A memory leak error exists in the VFS file lease handling code in "/fs/locks.c". This may be exploited by local users to cause a DoS (memory exhaustion) by performing certain Samba requests that causes an "fasync" entry to be re-allocated by the "fcntl_setlease()" function after the "fasync" queue has already been cleaned by the "locks_delete_lock()" function.

4) An integer overflow error exists in the "invalidate_inode_pages2_range()" function of "/mm/truncate.c". This can be exploited by local users to cause a DoS.

The vulnerabilities have been reported in the 2.6 kernel branch.

Solution
The vulnerabilities have been fixed in version 2.6.15-rc3.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Oleg Nesterov
2) Avi Kivity

Changelog
Further details available to Secunia VIM customers

Original Advisory
Kernel.org:
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.15-rc3
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7ed0175a462c4c30f6df6fac1cccac058f997739
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3a9388e4ebea57583272007311fffa26ebbb305
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=479ef592f3664dd629417098c8599261c0f689ab
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.15-rc2
http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=dc15ae14e97ee9d5ed740cbb0b94996076d8b37e

Red Hat Bugzilla:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174078
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174337

Deep Links
Links available to Secunia VIM customers