source: http://www.securityfocus.com/bid/4762/info

An attacker with root access may be able to write to kernel memory in spite of the security patch provided by grsecurity. The patch operates by redirecting the write() system call, when it is being used to write to a memory device. Unfortunately, there are other methods that can be used to write to kernel memory (such as mapping the device to memory using mmap()). 

https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/21458.tgz