My understanding is that it uses pulseaudio to avoid null pointer dereference protection, but the hole is in the tunneling driver.
This exploit used a trivial root exploit to setup a deeper kernel level exploit, that can bypass SELinux, hide itself completely, etc.