The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21 and possibly 2.4.x allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length which triggers a BUG_ON call when an attempt is made to perform a checksum.