vga_ioctl() syscall allows code execution in kernel.
vulners.com/securityvulns/securityvulns:doc:15590