More specifically, the physical pages backing these ring buffers are pinned and mapped into both address spaces. (The kernel needs to be able to read submissions (sqes) off of it and write completions (cqes) into it, and could not do that if it were only mapped in userspace, or could be paged out.)