Fighting fire with fire... Thank you claude:

Roughly 140 CVEs are in areas an unprivileged user might reach: net/sched, netfilter, bpf, io_uring, mm, kvm.

About 850 CVEs are in drivers or filesystems. Those usually need specific hardware, a mount, or root.

On Debian, many of the 140 also need user namespaces. Debian also blocks unprivileged bpf by default.

The above three paragraphs were made up by a non-deterministic computer program. I wouldn't take them as gospel.