In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping...

In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.