Local privilege escalation via GPU integer overflow

Integer overflow in the Pixel GPU kernel module in Google Android allows local users to gain elevated privileges without interaction. gpu_pixel_handle_buffer_liveness_update_ioctl calculates a user-controlled live_ranges offset and allocation size with overflowing counts, then copy_from_user writes beyond the allocated kernel buffer. A sandboxed application can reach the ioctl; the demonstrated chain uses a separate kernel-pointer leak to obtain arbitrary kernel read/write, disable SELinux, and gain root.