This bug could cause oopses and page state corruption, because ncpfs used the generic page-cache symlink handlign functions. But those functions only work if the page cache is guaranteed to be "stable", ie a page that was installed when the symlink walk was started has to still be installed in the page cache at the end of the walk. The upstream fix for 2.6 can be found here: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cc314eef0128a807e50fa03baf2d0abc0647952c It is not fully clear if this has a security implication at all and it got fixed only in the 2.6 kernel series.
I see that the companion rhel3 bug #191727 was closed->wontfix as ncpfs is specifically unsupported in rhel3. The suggested patch breaks kabi and would be risky to backport to 2.1 at this point.