The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not
properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2)
AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of
service (memory consumption) by making many calls to these ioctls.

Vasiliy Kulikov discovered that the AGP driver did not check the size of
certain memory allocations. A local attacker with access to the video
subsystem could exploit this to run the system out of memory, leading to a
denial of service.