Description
drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.7.1.el6 | RHSA-2010:0842 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | perf +10 | 2.6.33.7-rt29.47.el5rt | RHSA-2010:0958 |
Advisories 2
- RHSA-2010:0958 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0842 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4
- FEDORA-2010-18983 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=637688
- USN-1041-1 vendor-advisory
- SUSE-SA:2011:007 vendor-advisory
- ADV-2010-3321 vdb-entry
- RHSA-2010:0842 vendor-advisory
- ADV-2011-0298 vdb-entry
- RHSA-2010:0958 vendor-advisory
- SUSE-SA:2010:050 vendor-advisory
- SUSE-SA:2010:051 vendor-advisory
- 42758 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- 44067 vdb-entry
- 42745 third-party-advisory
- ADV-2011-0070 vdb-entry