security flaw

Array index overflow in the xfrmskpolicyinsert function in xfrmuser.c in Linux kernel 2.6 allows local users to cause a denial of service oops or deadlock and possibly execute arbitrary code via a p-dir value that is larger than XFRMPOLICYOUT, which is used as an index in the sock-skpolicy array...