The interesting boundary is all the prerequisites, not just the root shell claim. The source says the PoC chains an RDS zerocopy double-free with io_uring fixed buffers into a page-cache overwrite of a readable SUID-root binary, with RDS TCP, module loading, io_uring, and the right target all having to line up.