The Wikipedia article continues:
This places the stack base in an area 8 MB wide containing 524,288
possible positions; and the mmap base in an area 1 MB wide containing
256 possible positions.
The latter is way too small to be effective, and an attacker only needs to probe 256 addresses in one segment to find the
mmap() address pointer.
What the article doesn't mention is the limited use of ASLR in Linux. Traditionally the 2.6 kernel only used ASLR for (network) processes in specific memory areas (when PIE compiled) while loading the VDSO to a fixed address. Such a measure is only effective if all the addresses are randomized. Newer kernels have better support for address randomization. Note that various Windows versions did the exact same thing.