Do you mean having malware code already running in kernel space, or having system permissions to install new kernels? For the latter case, there are now mecha

Do you mean having malware code already running in kernel space, or having system permissions to install new kernels? For the latter case, there are now mechanisms that aim to prevent root from modifying the kernel or otherwise getting ring 0 access, see eg https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7.html https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7.... But even in a non locked down mode, there are practical advantages for the adversary in using officially supported interfaces vs their own kernel module or leveraging some i/o path to access kernel memory.