A race condition in the Linux kernel's watch_queue subsystem was fixed. The vulnerability involves a race between watch_queue_set_size() and post_one_notification() functions, which can lead to a NULL pointer dereference and kernel panic. An unprivileged user can trigger this by racing certain ioctl calls on a notification pipe, causing a fatal exception in the kernel.