“CVE-2021-22555 is a 15 years old heap out-of-bounds write vulnerability in Linux Netfilter that is powerful enough to bypass all modern security mitigations and achieve kernel code execution.”
Two zero bytes written past the end of a buffer. That was enough to break out of a Kubernetes pod and own the kernel. The bug sat in Netfilter for 15 years. He found it by grepping for memset. Every container boundary is only as strong as the oldest code in the kernel.