The SNMP NAT helper netfilter can cause a memory corruption. The corruption can be triggered remotely when the ip_nat_snmp_basic module is loaded and traffic on port 161 or 162 is NATed. Proposed upstream fix can be found here: https://lists.netfilter.org/pipermail/netfilter-devel/2006-May/024422.html
patch is in, there doesn't look to be a way to reproduce the bug itself reliably.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0580.html