Problem Description:
When msync(MS_INVALIDATE) is called on a mapping of an unmanaged
device object, the physical pages in the mapping range are marked
invalid but remain in the pager's page list. A subsequent page
fault will cause the fault handler to re-insert the page into the
object's list. This corrupts the list, and on object destruction
the page is freed twice.
Impact:
An unprivileged local user with access to a device that provides
memory-mapped I/O can trigger a use-after-free in the kernel, though
this is limited to a pool of objects ("fictitious pages") that are
never recycled for a different purpose. It may be possible to
exploit this to escalate privileges.