On a VM host, only root will be able to mount filesystems or make block-level writes to already-mounted filesystems. So LPE via a filesystem you'd need an exploit that can be triggered by writing to an already mounted filesystem with filesystem operations only as a non-root user.

As I understand it, even commonly-used filesystems aren't considered hardened against arbitrary malicious data, the party line is to use userspace filesystems to mount untrusted volumes.

What about namespaces, if a user creates a user namespace and becomes root inside it?