Comment by cthalupa

But that's not how that works. KVM is as "bare-metal" in access to the system as ESXi is. The hypervisor code runs in ring 0 in both cases.