The kernel in Red Hat Enterprise Linux 3 when running on SMP systems allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID) which prevents a spinlock from being unlocked.