Taking a page from the kernel's book: A TLB issue in mremap()
Jann Horn of Google Project Zero disclosed CVE-2018-18281, a Linux kernel bug in which mremap()'s move_ptes() releases a page reference before the TLB flush on the old address range, leaving a race window in which another task can free the page. On kernels...