Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7911
