Kernel Mode vs User Mode.

The two CPU privilege levels enforced by modern operating systems — kernel mode (supervisor, ring 0) with full hardware access and user mode (ring 3) restricted to its own address space and limited instructions. It belongs to the Identity & Access category of cybersecurity.

The two CPU privilege levels enforced by modern operating systems — kernel mode (supervisor, ring 0) with full hardware access and user mode (ring 3) restricted to its own address space and limited instructions.

Modern CPUs implement protection rings; x86 defines four (0-3) but mainstream OSes use only ring 0 (kernel/supervisor) and ring 3 (user). In kernel mode the processor can execute privileged instructions, write the page tables, access I/O ports, and manipulate hardware. In user mode it is confined to its own virtual address space and must request kernel services through controlled gateways — syscalls (syscall/sysenter on x86_64, svc on ARM64) or hardware interrupts. This boundary is what makes operating systems robust: a crashing browser cannot poke the kernel, and a compromised process needs a kernel exploit to gain ring 0. Hypervisors add ring -1 (VMX root), and SMM and ARM TrustZone provide deeper trust states. Understanding the boundary is essential to reasoning about EDR, rootkits, and eBPF.

Defences for Kernel Mode vs User Mode typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: ring 0 vs ring 3, supervisor vs user mode.