From graphics driver to root shell: a tour of Samsung’s kernel protections

Jamf Threat Labs demonstrates how a Qualcomm KGSL/GPU DMA vulnerability (CVE-2025-21479) can bypass Samsung's EL2/hypervisor kernel protections (RKP, KDP, DEFEX, JOPP/ROPP) by performing DMA writes that do not trigger CPU Stage 2 checks, using a self-referencing page-table trick to gain fast arbitrary read/write, disabling SELinux, and injecting code into the init process to obtain persistent root on affected Galaxy devices.