Description
The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-13etch1 | DSA-1356-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +10 | 2.6.18-8.1.10.el5 | RHSA-2007:0705 |
Advisories 2
- RHSA-2007:0705 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1356-1 linux-2.6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 25263 vdb-entry
- 26389 third-party-advisory
- 27227 third-party-advisory
- 26664 third-party-advisory
- 26643 third-party-advisory
- SUSE-SA:2007:051 vendor-advisory
- SUSE-SA:2007:053 vendor-advisory
- https://issues.rpath.com/browse/RPL-1620
- USN-510-1 vendor-advisory
- DSA-1356 vendor-advisory
- USN-509-1 vendor-advisory
- oval:org.mitre.oval:def:11196 vdb-entry signature
- 26760 third-party-advisory
- RHSA-2007:0705 vendor-advisory
- MDVSA-2008:105 vendor-advisory
- ADV-2007-2854 vdb-entry
- 26500 third-party-advisory
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.2
- 26450 third-party-advisory