Multiple race conditions in the madvise_remove function in mm/madvise.c in
the Linux kernel before 3.4.5 allow local users to cause a denial of
service (use-after-free and system crash) via vectors involving a (1)
munmap or (2) close system call.

A flaw was discovered in the madvise feature of the Linux kernel's memory
subsystem. An unprivileged local use could exploit the flaw to cause a
denial of service (crash the system).