Kernel privilege escalation via cache-size integer overflow

Out-of-bounds write in the PowerVR GPU kernel component in Google Android SoC allows local users to gain kernel privileges. An integer calculation in CacheOpPMRExec in cache_km.c overflows, causing the function to write outside the intended buffer. Local code execution on a device using the affected SoC is required; no user interaction or additional execution privileges are needed, and successful exploitation grants kernel-level control.