Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the
Linux kernel before 2.6.39.3, when Kernel SamePage Merging (KSM) is
enabled, allows local users to cause a denial of service (NULL pointer
dereference) or possibly have unspecified other impact via a crafted
application.

Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service.