“Most serious” Linux privilege-escalation bug ever is under active exploit
  CVE-2016-5195

  This flaw allows an attacker with a local system account to
  modify on-disk binaries, bypassing the standard permission
  mechanisms that would prevent modification without an
  appropriate permission set. This is achieved by racing the
  madvise(MADV_DONTNEED) system call while having the page of
  the executable mmapped in memory.

Excellent example why mounting partition with system binaries (such as /usr) read-only is a good idea. CoreOS does this.[EDIT] added "read-only"