Comment by dralley

Linux these days tends to use eBPF which isn't really in userspace per-se.