The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11196
https://issues.rpath.com/browse/RPL-1620
http://www.vupen.com/english/advisories/2007/2854
http://www.ubuntu.com/usn/usn-510-1
http://www.ubuntu.com/usn/usn-509-1
http://www.securityfocus.com/bid/25263
http://www.redhat.com/support/errata/RHSA-2007-0705.html
http://www.novell.com/linux/security/advisories/2007_53_kernel.html
http://www.novell.com/linux/security/advisories/2007_51_kernel.html
http://www.mandriva.com/security/advisories?name=MDVSA-2008:105
http://www.debian.org/security/2007/dsa-1356
http://secunia.com/advisories/27227
http://secunia.com/advisories/26760
http://secunia.com/advisories/26664
http://secunia.com/advisories/26643
http://secunia.com/advisories/26500
http://secunia.com/advisories/26450