If the kernel you are running on is vulnerable, it can be attacked and the attacker can circumvent any container isolation.
If the hypervisor (Xen!) running underneath your container-Linux is vulnerable, the attacker can get access to your virtualized OS and circumvent any container isolation.
