fusermount-racecondition.tgz
At least on ubuntu lucid, the fusermount tool contains a timerace mounting a user filesystem and updating mtab, thus mtab entries with arbitrary paths can be created. Crafted mtab entries can then be used to unmount live parts of the filesystem. Proof of concept code included.
original thread: only registered users with at least 25 hack challenge points can see links: click here in order to visit the hack challengeshttp://packetstormsecurity.org/filedesc/fusermount-racecondition-tgz.html