Description
The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-24lenny1 | DSA-2094-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.7.1.el6 | RHSA-2010:0842 |
Advisories 2
- RHSA-2010:0842 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2094-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
- SUSE-SA:2010:041 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6
- MDVSA-2010:198 vendor-advisory
- SUSE-SA:2010:040 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53
- ADV-2010-2430 vdb-entry
- SUSE-SA:2011:007 vendor-advisory
- RHSA-2010:0842 vendor-advisory
- ADV-2011-0298 vdb-entry
- http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=1b2f1489633888d4a06028315dc19d65768a1c05
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.4
- DSA-2094 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=621435
- http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
- SUSE-SA:2010:054 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21
- 41512 third-party-advisory