Just saw this on bugtraq:

Linux kernel do_mremap local privilege escalation vulnerability
http://isec.pl/vulnerabilities/isec-0013-mremap.txt

...Kevin