It would help a lot if someone could include a pointer to the appropriate thread(s) on lkml, or to something else which explained the purported security hole. I can't find a description of it anywhere.