The rs_ioctl function in drivers/char/amiserial.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.