It was mentioned in this thread that kernel exploits usually use syscalls to trigger undesired behavior:
Are there any ways or known examples which do not use syscalls? What about programs beyond the kernel?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A kernel exploit (or anything at all) not using syscalls will be pretty useless.
Imagine writing a module without
socket functions, no memory allocation, no IO functions...
Kernel malware needs the syscalls to intercept file read and write, open sockets, create files, read and write process memory, and so on. Anything that does not read or write anything, does not do any disk or network IO, does not allocate memory and does not even get the time of day isn't really doing anything at all, let alone do something malicious.