Inject into a root process with cap_sys_ptrace
A shell or binary holding cap_sys_ptrace can attach to a root-owned process and hijack it to run your shellcode as root.
Tag: capabilities
Escalate through Linux file capabilities
A binary carrying cap_setuid or cap_dac_read_search grants root-equivalent power without any SUID bit, and defenders rarely audit it.