However, it does necessitate that the attacker run local code and manipulate JIT-compiled cBPF programs, meaning it is not a direct remote network attack.

So, a form of privilege escalation as access is required.