In RGXBackingZSBuffer of rgxta3d.c, there is a possible arbitrary code
execution due to a use after free. This could lead to local escalation of
privilege in the kernel with no additional execution privileges needed. User
interaction is not needed for exploitation.