{"id":"CVE-2007-3851","aliases":["DSA-1356-1","EUVD-2007-3835","GHSA-fvc6-7939-69wx","RHSA-2007:0705"],"status":"published","title":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later...","description":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.","severity":{"version":"2.0","score":6,"vector":"AV:L/AC:H/Au:S/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00313,"percentile":0.24418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-399"],"published":"2007-08-13T19:00:00Z","modified":"2026-06-26T12:18:02Z","affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"linux-2.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.18.dfsg.1-13etch1"}]}],"versions":["2.6.18.dfsg.1-12","2.6.18.dfsg.1-12etch1","2.6.18.dfsg.1-12etch2","2.6.18.dfsg.1-13"],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-8.1.10.el5"}]}],"bundled":8}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.securityfocus.com/bid/25263","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/26389","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/27227","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/26664","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/26643","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.novell.com/linux/security/advisories/2007_51_kernel.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.novell.com/linux/security/advisories/2007_53_kernel.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://issues.rpath.com/browse/RPL-1620","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.ubuntu.com/usn/usn-510-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.debian.org/security/2007/dsa-1356","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.ubuntu.com/usn/usn-509-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11196","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://secunia.com/advisories/26760","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2007-0705.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:105","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2007/2854","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://secunia.com/advisories/26500","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.2","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/26450","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3851","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fvc6-7939-69wx"},{"url":"https://access.redhat.com/errata/RHSA-2007:0705","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=232260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=245773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=245774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=247726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=251185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=253313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=253314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=253315","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0705.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-1217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=402741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1217","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-2875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2875","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-2876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-2878","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2878","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=294941","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3739","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=275881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3740","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=275901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3843","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3851","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3851","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2007-3851","description":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.","status":"published","published":"2007-08-13T19:00:00Z","modified":"2024-08-07T14:28:52.591Z","updated_at":"2026-11-02T13:32:45.563938Z"}],"euvd":[{"id":"EUVD-2007-3835","description":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.","status":"published","published":"2007-08-13T19:00:00Z","modified":"2024-08-07T14:28:52Z","updated_at":"2026-11-03T01:16:24.545796Z"}],"ghsa":[{"id":"GHSA-fvc6-7939-69wx","title":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later...","description":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.","status":"published","published":"2022-05-01T18:17:49Z","modified":"2023-01-31T05:04:12Z","updated_at":"2026-11-02T14:48:37.736488Z"}],"nvd":[{"id":"CVE-2007-3851","description":"The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.","status":"published","published":"2007-08-13T19:17:00Z","modified":"2026-06-16T22:42:54.013Z","cvss":[{"version":"2.0","score":6,"vector":"AV:L/AC:H/Au:S/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:01:19.102336Z"}],"osv":[{"id":"DSA-1356-1","title":"linux-2.6 - several vulnerabilities","status":"published","published":"2007-08-15T00:00:00Z","modified":"2026-03-09T01:01:49.38057Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"RHSA-2007:0705","title":"Red Hat Security Advisory: kernel security update","status":"published","published":"2024-09-15T16:49:28Z","modified":"2026-06-26T12:18:02.204241784Z","updated_at":"2026-11-02T15:52:59.70892Z"}]}}