Comment by kloop

I think OP's point is that, if the attacker already has root, they haven't gained any new capabilities from the CVE. They could just do whatever they wanted much more directly. Therefore, the inherent risk seems fairly low.