From Slashdot: "Tavis Ormandy and Julien Tinnes have discovered a severe security flaw in all 2.4 and 2.6 kernels since 2001 on all architectures. 'Since it leads to the kernel executing code at NULL, the vulnerability is as trivial as it can get to exploit: an attacker can just put code in the first page that will get executed with kernel privileges.'" Note: this is a local exploit, not remote. Looks like the fix for this is in the current tree and is being run through the standard processes. The above link includes all the gory details.