I'm assuming it is possible for an attacker to bypass the Linux kernel to make changes to system memory, hard drives etc.
Both main memory and disk drives are managed solely by the kernel.
For a user space program to access these it needs the kernel's cooperation through the invocation of system calls.
A kernel module can access them without further approval, because it's already part of the kernel. Of course to become a kernel module kernel cooperation is again required.