[LG V20 Questions & Answers] Rortiz2:
Yeah this works!

Sadly it doesn't spawn a root shell xD:

r0rtiz2@r0rtiz2-X540LA:~/Descargas$ adb shell
:/ $ cd data
:/data $ cd local
:/data/local $ cd tmo
/system/bin/sh: cd: /data/local/tmo: No such file or directory
2|:/data/local $ cd tmp
:/data/local/tmp $ ls
cve-2019-2215 su97
:/data/local/tmp $ ls
cve-2019-2215 su97
:/data/local/tmp $ rm c*
:/data/local/tmp $ chmod 755 *
:/data/local/tmp $ ./su97
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xffffffde57115940
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xffffffdee7ad78b0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0xffffffde544bc000
CHILD: Finished write to FIFO.
PARENT: leaking successful
MAIN: parsing kernel stack to find thread_info
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xffffffde57115940
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xffffffde6b543cb0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
CHILD: extra leak
CHILD: Finished write to FIFO.
PARENT: writev() returns 0x17008
PARENT: Reading leaked data
PARENT: Reading extra leaked data
PARENT: leaking successful
MAIN: task_struct_ptr = ffffffde57115940
MAIN: stack = ffffffde544bc000
MAIN: thread_info_ptr = ffffffde544bc000
MAIN: Clobbering addr_limit
PARENT: clobbering at 0xffffffde544bc008
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69648
PARENT: readv returns 69648, expected 69648
PARENT: clobbering test passed
MAIN: thread_info = 0xffffffde544bc000
MAIN: should have stable kernel R/W now
MAIN: searching for cred offset in task_struct
MAIN: search_base = f000000000000000
MAIN: searching for selinux_enforcing
MAIN: searching for kallsyms format strings
MAIN: **partial failure** cannnot fix kallsyms format string
MAIN: searching for kallsyms table
MAIN: **fail** cannot find kallsyms table
MAIN: direct search didn't work, so searching via avc_denied
MAIN: searching for kallsyms format strings
MAIN: **partial failure** cannnot fix kallsyms format string
MAIN: searching for kallsyms table
MAIN: **fail** cannot find kallsyms table
MAIN: setting root credentials with cred offset 618
MAIN: UID = 0
MAIN: enabling capabilities
MAIN: SECCOMP status 0
MAIN: **FAIL** did not find selinux_enforcing symbol
MAIN: re-joining init mount namespace
open: Permission denied
1|:/data/local/tmp $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0
:/data/local/tmp $

Ignore the name of the binary xD It was just cause I had the other downloaded and bla bla..