Description
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-19lenny2 | DSA-1927-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.9etch1 | DSA-1928-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-164.9.1.el5 | RHSA-2009:1670 |
| RHEL 4 | kernel +10 | 2.6.9-89.0.18.EL | RHSA-2009:1671 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 ELS | kernel +8 | 2.4.21-66.EL | RHSA-2010:0882 |
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-137.el5rt | RHSA-2009:1540 |
Advisories 6
- RHSA-2010:0882 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1671 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1540 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1670 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1927-1 linux-2.6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1928-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20091019 Re: CVE request: kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised mailing-list
- RHSA-2009:1671 vendor-advisory
- 36824 vdb-entry
- oval:org.mitre.oval:def:9891 vdb-entry signature
- RHSA-2009:1540 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=529597
- SUSE-SA:2009:061 vendor-advisory
- USN-864-1 vendor-advisory
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- 36707 third-party-advisory
- MDVSA-2010:198 vendor-advisory
- [linux-kernel] 20090921 [git pull] drm tree. mailing-list
- MDVSA-2010:088 vendor-advisory
- SUSE-SA:2010:012 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.31-git11.log
- 37909 third-party-advisory
- oval:org.mitre.oval:def:6763 vdb-entry signature
- RHSA-2010:0882 vendor-advisory
- RHSA-2009:1670 vendor-advisory
- SUSE-SA:2009:064 vendor-advisory
- [oss-security] 20091019 CVE request: kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised mailing-list
- 38834 third-party-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7dc482dfeeeefcfd000d4271c4626937406756d7
- SUSE-SA:2010:013 vendor-advisory
- FEDORA-2009-11038 vendor-advisory
- ADV-2010-0528 vdb-entry