Polluting sys_execve() in kernel space without depending on the sys_call_table[]: A paper discussing design weaknesses in the linux kernel's handling of simply linked lists used to register binary formats.
5bab784fdae67fe78750787219691922c7fba25f0f603bd21fe35ea0e6182510