A vulnerability exists in the implementation of the mremap() system call in the Linux operating system, which allows an attacker to gain access to the physical page.

The vulnerability in the implementation of the mremap system call in the Linux operating system exists due to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to gain access to the physical page...

CVE-2018-18281

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...