There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could allow unintended GPU opcodes to be executed.
Deceiving Android’s GPU Driver to Remotely Root Android Devices
There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could allow unintended GPU opcodes to be executed.
Deceiving Android’s GPU Driver to Remotely Root Android Devices