Followup - this isn't a denial of updatedb service because updatedb  does not use -follow or -L.  However, the problem is significant from a security perspective in other contexts.

Once again, -L should not be used in security-sensitive environments in any case.

NB: THIS BUG IS A SECURITY HOLE (denial of "updatedb" service by users, possibly denial of service to security checks based on find).  Please note the list of affected versions of findutils.

The problem was introduced because safely_chdir() in find.c now sometimes avoids needing to stat the destination directory, and so stat_buf was left unpopulated.  This problem is fixed by the attached patch, which has been committed into the development code.   The scope of the security problem extends only to the indefinite loop, the problem does not result in users being able to persuade find to process parts of the filesystem that should be excluded.

Having said this, this bug only occurs if the "-L" option was used, which normally should not be the case with any security checks - because they should not follow symbolic links, in general.

The next release of findutils will include this fix.  The NEWS file will outline the severity of the problem.