Comment by ronsor

LPEs are usually used to escalate to root, but in many of them, the kernel itself is compromised. There's just little reason to do stuff in kernel space when you can get root and load kernel modules anyway.