Here is an important distinction to make: contrary to NT, syscalls in a given thread do not call back to userspace in the same thread. In NT, KeUserModeCallbac

Here is an important distinction to make: contrary to NT, syscalls in a given thread do not call back to userspace in the same thread. In NT, KeUserModeCallback implements some sort of a coroutine pattern, where the kernel space can call back to the user code synchronously in the same thread and expect it to return to the callsite. In Linux, there's no such thing as a user-mode callback: a given thread cannot have any user code running (or scheduled to be run) while simultaneously having the kernel call stack active. > seccomp filters, FUSE, ptrace, userfaultfd, fanotify > core_pattern handler > usermode helpers These either block the current thread waiting for another thread (e.g. a debugger, fault handler, or filesystem server) to complete the request, or fires off the request asynchronously. > syscall_user_dispatch This does not "call back" into userspace at all; it merely delivers SIGSYS. Signal delivery works more like NT's user APCs: there's no kernel-side context active in the thread the signal handler (or the APC) is running.