Withdrawn by the publisher.

fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

kernel: local denial of service due to NT bit leakage kernel-xen 3.1.1 does not prevent modification of the CR4 TSC from applications (DoS possible) kernel: Reinstate ZERO_PAGE optimization in 'get_user_pages()' and fix XIP Linux kernel dccp_setsockopt_change() integer overflow kernel: missing boundary checks in syscall/syscall32_nopage() kernel: remove SUID when splicing into an inode kernel: open() call allows setgid bit when user is not in new file's group kernel: splice: fix bad unlock_page() in error case