Kernel privilege escalation via wrapped GPU range

Integer overflow in Qualcomm Snapdragon Graphics Linux allows local users to gain kernel read-write access through a crafted KGSL IOCTL. The kgsl_iommu_set_svm_region function adds user-controlled GPU addresses and sizes without rejecting wraparound, enabling overlapping mappings and dangling IOMMU page-table entries. Local KGSL device access and a successful mapping race are required; GPU commands can then read or modify freed kernel pages and elevate privileges.