It's possible to access kernel memory via system calls.
vulners.com/securityvulns/securityvulns:doc:6430