Samsung patches three Exynos NPU driver flaws enabling Android privilege escalation

Samsung has patched three high-severity vulnerabilities in the Exynos NPU driver—CVE-2025-23099, CVE-2025-23103, and CVE-2025-23107—that could allow local privilege escalation on affected Galaxy devices. The flaws impact Samsung Galaxy S24+ devices running Android 14 and systems based on Exynos 1480 and 2400 platforms, and each issue is reachable by a malicious application running in the untrusted_app SELinux context with low privileges and no user interaction. Samsung assigned a CVSS v3.1 score of 7.8 to the bugs and released fixes through Product Security Updates in early June.

The vulnerabilities stem from missing length checks in multiple NPU driver paths, leading to out-of-bounds writes in kernel memory. CVE-2025-23099 involves queue preparation logic that can reuse smaller prior allocations while trusting larger attacker-controlled counts, CVE-2025-23103 arises from an unbounded loop counter in npu_queue_update that can exceed the allocated queue_list size, and CVE-2025-23107 affects fill_vs4l_buffer, which writes kernel-side buffer metadata into an undersized user-supplied structure. STAR Labs SG credited Billy Jheng Bing-Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng with reporting the issues.