Sending crafted packets to a 2.6 series kernel with netfilter rules matching TCP options (using the –tcp-option match) may result in a Denial of Service.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33693/20040630-2.6-tcpoption.txt
Source: https://packetstormsecurity.com/files/33693/HexView-Security-Advisory-2004-06-30.2.html