nfnetlink_log in netfilter in the Linux kernel before 2.6.20.3 allows attackers to cause a denial of service (crash) via unspecified vectors involving the (1) nfulnl_recv_config function (2) using \multiple packets per netlink message\ and (3) bridged packets which trigger a NULL pointer dereference.