The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.2
secunia.com/advisories/26389
secunia.com/advisories/26450
secunia.com/advisories/26500
secunia.com/advisories/26643
secunia.com/advisories/26664
secunia.com/advisories/26760
secunia.com/advisories/27227
www.debian.org/security/2007/dsa-1356
www.mandriva.com/security/advisories?name=MDVSA-2008:105
www.novell.com/linux/security/advisories/2007_51_kernel.html
www.novell.com/linux/security/advisories/2007_53_kernel.html
www.redhat.com/support/errata/RHSA-2007-0705.html
www.securityfocus.com/bid/25263
www.ubuntu.com/usn/usn-509-1
www.ubuntu.com/usn/usn-510-1
www.vupen.com/english/advisories/2007/2854
issues.rpath.com/browse/RPL-1620
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11196