These are distinct vulnerabilities counted by the number of patches. The patch generation system performs variant analysis. So, each patch can potentially stop multiple exploits. The raw exploits number is higher than what we reported in the post. We don't want to cause the confusion why #patch != #exploit, so we used the smaller number there. These vulns are all kernel specific. Userspace software running as root was not in scope of the analysis.

I'm not skeptical. Linux has had so many LPE bugs in the past that most people consider it to be a "best effort" thing and nobody actually relies on it. Shared machines are mostly used in companies or universities as a kind of admin tool - the users are more or less trusted.

The only exception I know of is Android. It would be interesting to know how many of these vulnerabilities work there. Can't be zero anyway...