Description
The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | linux-2.6 | 2.6.32-34squeeze1 | DSA-2240-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +13 | 2.6.32-71.29.1.el6 | RHSA-2011:0498 |
Advisories 2
- RHSA-2011:0498 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2240-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110224 CVE request: kernel: drm/radeon/kms: check AA resolve registers on r300 mailing-list
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.38-rc5
- kernel-atiradeon-sec-bypass(65691) vdb-entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef
- [oss-security] 20110224 Re: CVE request: kernel: drm/radeon/kms: check AA resolve registers on r300 mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=680000
- [oss-security] 20110225 Re: CVE request: kernel: drm/radeon/kms: check AA resolve registers on r300 mailing-list
- 46557 vdb-entry