Linux rpc.nfsd has real_path bug. Vulnerable are RedHat 5.2 and Debian 2.1, local only in most cases.