Control-flow integrity (CFI) has been widely adopted to enhance application-layer software security. However, protecting indirect control-flow transfers at the kernel level—particularly within cloud environments hosting guest kernels—remains an underexplored challenge. Existing kernel-level CFI mechanisms predominantly rely on compile-time instrumentation of indirect branches. As a result, even minor kernel updates often necessitate system-wide recompilation or kernel reboot, which significantly hampers service continuity in cloud-based deployments. To overcome these limitations, we propose a hardware-assisted monitoring framework that leverages hardware branch tracing and performance monitoring units to provide lightweight protection for kernel-level indirect control flows—without requiring any kernel source modifications. This design supports dynamic deployment and policy updates without recompilation. We implement a prototype system, Hamk-CFI, within a standard KVM virtualization environment tailored for cloud services. Experimental results demonstrate that Hamk-CFI achieves strong security guarantees with minimal performance overhead—only 0.22% in standard benchmark tests—while offering flexible and dynamic policy configuration.