[marcosdumay]

> Port 445 that was used in an attack is opened by a kernel driver that runs in ring 0.

You know, not too long ago, Linux used to run NFS on ring 0 too.

There was a good reason for those things, you can find them on the performance comparatives between CPU and network at the time.