There are basically three ways to attempt to write into kernel memory
it can be stored into directly if it is mapped writeable into the process address space
a system call can be faked into changing it by passing a kernel address into a system call that has an output buffer as an argument.
there may be drivers whose purpose is to provide access to memory.