In case of kernel-space network drivers, all three regions are mapped to kernel space, and any access to these from the user space is typically abstracted out via either ioctl() calls or read()/write() calls, from where a copy of the data is provided to the user-space application.

https://www.embedded.com/design/operating-systems/4401769/Device-drivers-in-user-space