Apparently the "fix" was identified, any ideas when this will be backported to KP?

Not sure about 2.6.28, but backported to my 4.0.5 server, there had been changes so the patch in the commit wouldn't cleanly go in... but was close enough to easily figure out

Supposedly it's been around since 2.6.22 but "harder" to exploit ... and as I don't have many random binaries I run on my N900, probably somewhat safe. The regular PCs with <koff>flashplayer and any with outward facing shell access I have to be worried about...