The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID), which prevents a spinlock from being unlocked.
http://www.kb.cert.org/vuls/id/245984
http://support.avaya.com/elmodocs2/security/ASA-2006-254.htm