Kernel crash or disclosure via unlocked policy replacement

Use-after-free in mm/mempolicy.c in Linux Kernel allows local users to crash the system or disclose kernel memory through a race. mbind() replaces a VMA's vm_policy pointer and frees the old policy without the per-VMA write lock while a concurrent page fault can still use it. Exploitation requires local low-privileged access, a kernel built with CONFIG_NUMA, and winning the race; the result is a crash, memory disclosure, or memory corruption.