Race condition between the kfree_skb and __skb_unlink functions in the socket buffer handling in Linux kernel 2.6.9 and possibly other versions allows remote attackers to cause a denial of service (crash) as demonstrated using the TCP stress tests from the LTP test suite.