The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a a binary compatibility interface (lcall).
http://www.securityfocus.com/bid/4259
http://www.redhat.com/support/errata/RHSA-2002-158.html
http://www.openwall.com/linux/
http://www.iss.net/security_center/static/8420.php
http://www.debian.org/security/2004/dsa-442
http://www.debian.org/security/2003/dsa-336
http://www.debian.org/security/2003/dsa-332
http://www.debian.org/security/2003/dsa-312