Modern CPUs run in at least two privilege levels. Kernel mode can touch any hardware and any memory. User mode is restricted, and that is where your application code lives.
Your program cannot directly access devices or other processes' memory while in user mode. When it needs a privileged action, it makes a system call, which safely transfers control to kernel code running in kernel mode.
We need both because trust is not free. If every program ran with full privileges, one bug or one malicious line could crash the machine or steal data. The two-mode split lets the kernel police every dangerous action. User code stays sandboxed, and the kernel stays the single gatekeeper.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
