...itself has received a fairly thorough examination, it is not itself without bugs that may be directly exposed to user modeapplications, or indirectly via some other kernel code. Four relevant examples have been provided in Appendix C. 2.6...
http://www.ngssoftware.com/research/papers/Attacking-the-Windows-Kernel.pdf