I understand that when a page fault occurs in user space (Ring 3), the fault handler can read the saved CS register from pt_regs to confirm CPL=3, then send SIGSEGV to the process and keep the kernel ...