Its not writing to the partition though is it? It is polluting the cache page via a write with a buffer overrun in the kernel. I don't think buffer overruns follow permissions.

I assumed such memory would be mapped readonly (PROT_READ), without actually looking into it..