One way is to create listening socket for some protocol, and module for that protocol will be loaded. For example, DCCP and SCTP.Are there other ways?UPD: Use case: virtual machine somewhere in AWS/Azure/... An attacker got local unprivileged user shell. No hardware changes can be done by unprivileged used. There is local privilege escalation vulnerability in kernel module that is not loaded now. How can he load this module to use it?Question inspired by recent vulnerability in DCCP protocol kernel module.UPD2: According to CVE-2017-2636, it's possible to load n_hdlc kernel module just by activating HDLC for tty device (russian article on CVE-2017-2636). So there are other ways, but nobody with this sacred knowledge was interested in the question :(
What are ways in Linux for non-root user to trigger kernel module loading
linux kernel;kernel modules;not root user
Many file-system drivers are implemented as kernel modules and will be loaded on demand, either because of user mounts or by the automount daemon.Additionally there is whole range of hot-plug devices where plugging them in will result in the kernel loading the required kernel module to manage them, with USB peripherals a very big sub category therein,  