According to upstream commit 0d54ee1c7850a954026deec4cd4885f331da35cc "security: introduce missing kfree" there is a missing kfree in
keyctl_join_session_keyring.
It looks like a local user could eventually cause a DoS by using up kernel memory, so I assigned this CVE-2009-0031.
http://git2.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d54ee1c7850a954026deec4cd4885f331da35cc
This should only affect the RHEL4,5,MRG kernels and not RHEL2.1,3 which did not have this code. I tested this on RHEL5 and kernel memory usage does increase (although it does take some time to DoS a machine and would likely be noticed, I've left the impact as important for now though).
Patch in URL above.