Candidate: CVE-2006-2445
References: 
 http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8f17fc20bfb75bcec4cfeda789738979c8338fdc
 http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=30f1e3dd8c72abda343bcf415f7d8894a02b4290
 http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f53ae1dc3429529a58aa538e0a860d713c7079c3
 http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ca531a0a5e01e5122f67cb6aca8fcbfc70e18e0b
Description: 
 Race condition in run_posix_cpu_timers in Linux kernel before 2.6.16.21
 allows local users to cause a denial of service (BUG_ON crash) by causing one
 CPU to attach a timer to a process that is exiting.
Notes: 
 jmm> Only exploitable on SMP systems
 jmm> 2.6.8 most probably not affected, but there was a reproducer posted to vendor-sec, should be double-checked
 jmm> Vulnerable code not present in 2.4
 dannf> 2.6.8 didn't have posix-cpu-timers
 mpitt> 2.6.10-hoary does not need 4th GIT patch, function does not exist
Bugs: 
upstream: released (2.6.16.21)
linux-2.6: released (2.6.16-15)
2.6.8-sarge-security: N/A
2.4.27-sarge-security: N/A
2.6.10-hoary-security: released (2.6.10-34.21) [GIT patches 1 to 3]
2.6.12-breezy-security: released (2.6.12-10.35) [GIT patches 1 to 3], needed [GIT patch 4]
2.6.15-dapper-security: released (2.6.15-26.44) [GIT patches 1 to 3], needed [GIT patch 4]
2.6.17-edgy: released