By passing negative argument to select() function it's possible to overwrite the fragment of kernel memory.
vulners.com/securityvulns/securityvulns:doc:3351