In this answer author states:
With the 64-bit x86_64 kernel, a 32-bit process can use the entire 4GB address space, except for a couple pages (8KB) at the end of the 4GB address space which are managed by the kernel.
What is the purpose of this kernel-managed memory? Shouldn’t it be in the kernel space, to prevent accidental corruption by the user?
Citing the kernel source: “Kernel pointers have redundant information, so we can use a scheme where we can return either an error code or a [...] pointer with the same return value.”
The values -1..-4095 (mapping to 0xfffff000–0xffffffff in 32-bit mode) are reserved for kernel-level errno values. The other 4KB from 0xffffe000–0xffffefff are held free for the vsyscall vdso magic page, but since the vdso page is relocatable since many moons, this area remains potentially unpopulated, that is to say, the [stack] entry in /proc/*/maps ends at 0xffffdfff always regardless of whether [vdso] is mapped at 0xffffe000 or elsewhere.
Some kernel memory can be inside the application user-space address space, and be sort-of mmap-ed with PROT_NONE. Some address space would then be used, but without being accessible by the program (so no corruption is possible).
来源：https://stackoverflow.com/questions/8547071/32-bit-process-s-address-space-on-64-bit-linux