Krzysztof Oledzki wrote:
> EIP is at sub_preempt_count+0x35/0x40
> 
> AFAIK there were some small fixes that went into 2.6.15-rc1 which were
> supposed to fix such problems with conntrack -L. Shuldn't we send them
> to -stable to make 2.6.14.x also usable?

I think so, at the least Yasuyuki's:
[NETFILTER] refcount leak of proto when ctnetlink dumping tuple

That fixes the problem that you're reporting.

-- 
Pablo