An unprivileged user can send a netlink message resulting in an out-of-bounds access of the sock_diag_handlers[] array which, in turn, allows userland to take over control while in kernel mode. Patch (already in net/master): http://thread.gmane.org/gmane.linux.network/260061 Affected versions: v3.3 - v3.8 PoC is not attached this time but can be requested on demand. Hint: Works well on Fedora 18, bypassing all mmap_min_addr checks. ;) Thanks, Mathias