The kernel does use hardware features for this kind of protection. It's done by using lightweight abstraction layers that are implemented per-architecture. Fo

The kernel does use hardware features for this kind of protection. It's done by using lightweight abstraction layers that are implemented per-architecture. For example, accesses to userspace memory all go through copy_from_user() / copy_to_user() / access_ok() and related functions. Behind this, S390 implements separate kernel/user address spaces; x86_64 implements SMAP; ARM64 implements PAN.