Confidential Virtual Machines (CVMs), such as AMD SEV, offer external protection but lack a privilege hierarchy, making them vulnerable to susceptible loadable kernel modules (LKMs). Although the Integrity Measurement Architecture (IMA) checks load-time integrity, it is prone to kernel exploits. While AMD SEV-SNP’s VM Privilege Levels (VMPLs) offer hardware-enforced intra-CVM isolation, they remain underexploited for kernel protection. This paper presents VMPL-KMI, utilizing VMPLs to enforce both load-time measurement and runtime protection of LKMs. By maintaining MList in the most privileged VMPL0 and synchronizing integrity checks with memory protection, VMPL-KMI prevents tampering and eliminates Time-Of-Check-to-Time-Of-Use (TOCTTOU) vulnerabilities. To minimize the overhead, we introduce a service protocol based on the Secure VM Service Module (SVSM) standard, reducing verification to a single interaction. Experimental results demonstrate practical efficiency: 5–10% overhead for small modules (over 20% for larger ones) during loading and less than 5% during unloading.