Samsung Exynos NPU Driver Out-of-Bounds Write Privilege Escalation

CVE-2025-23099 is a high-severity out-of-bounds write vulnerability in the Samsung Exynos NPU driver affecting Exynos 1480 and Exynos 2400 platforms, including Samsung Galaxy S24+ devices running Android 14. The root cause is a missing length check in NPU queue management. Specifically, the vulnerable logic is in the npu_queue_prepare and npu_queue_alloc functions: npu_queue_prepare allocates input and output queues via npu_queue_alloc and sets NPU_QUEUE_STATE_ALLOC, while npu_queue_alloc returns early without reallocating if that state is already set. As a result, a subsequent call to npu_queue_prepare with larger attacker-controlled container counts can reuse an earlier, smaller allocation. Execution then proceeds into npu_queue_mapping while trusting the larger user-supplied counts, leading to corruption of queue_list->count and q_container->count and ultimately an out-of-bounds write in kernel memory.