Why can the lower 2 bits in the process’s virtual address space be used as flags in Linux

I am leanring the source code for radix tree in the Linux kernel, and I am very curious about a function of the radix tree (as shown below), which uses the lower 2 bits of the pointer address of an entry as a flag for the internal node. Besides, I also found that the mmap module uses the lower 2 bit to identify the anonymous pages.

My question is, in the Linux process address space, the lower 2 bits are never used? In other words, the kmalloc function always allocates a pointer address whose lower 2 bits are 0. And is this feature available in user space?

static inline bool radix_tree_is_internal_node(void *ptr)
    return ((unsigned long)ptr & RADIX_TREE_ENTRY_MASK) ==


Linux Mint 20.3 “Una” Releases With Cinnamon 5.2, Theme Refresh, and a New Document Manager

A helper package for Go Telegram Client, i.e. gotd/td