CVE-2008-3272 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3272): The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.
Also fixed in 2.6.25.15 and 2.6.26.2
hardened-kernel unaffected at present time. Removing alias. PS: genpatches-2.6.25-10 included the 2.6.25.15 patch and genpatches-2.6.26-2 included the 2.6.26.2 patch