The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.

kernel: personality: fix PER_CLEAR_ON_SETID kernel: /proc/$pid/maps visible during initial setuid ELF loading kernel: SELinux and mmap_min_addr kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes kernel: x86_64 32 bit process register leak kernel: numerous getname() infoleaks kernel: tc: uninitialised kernel memory leak kernel: fs: pipe.c null pointer dereference kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7 kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500 kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket