fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file
descriptors within other epoll data structures without properly checking
for (1) closed loops or (2) deep chains, which allows local users to cause
a denial of service (deadlock or stack memory consumption) via a crafted
application that makes epoll_create and epoll_ctl system calls.

Nelson Elhage discovered that the epoll subsystem did not correctly handle
certain structures. A local attacker could create malicious requests that
would hang the system, leading to a denial of service.