Lets consider another spying mechanism in linux kernel - uprobes. They also insert int3 but this time in user-mode and can be used for example to steal TLS traffic. I made simple code to set up uprobe for /usr/bin/ls on PLT thunk getenv:
objdump -d /usr/bin/ls...
0000000000004710 <getenv@plt>:
4710:f3 0f 1e fa endbr64
4714:f2 ff 25 5d e5 01 00 bnd jmpq *0x1e55d(%rip) # 22c78 <getenv@GLIBC_2.2.5>
471b:0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
ls -i /usr/bin/ls
1043126 /usr/bin/ls
dmesg | tail
[258600.533089] uprobe ret_handler is executed, ip = 55EAECA62B54
[258600.533090] uprobe handler in PID 43831 executed, ip = 55eaeca56710
[258600.533093] uprobe ret_handler is executed, ip = 55EAECA62B6C
[258600.533095] uprobe handler in PID 43831 executed, ip = 55eaeca56710
[258600.533098] uprobe ret_handler is executed, ip = 55EAECA5861C
[258600.533099] uprobe handler in PID 43831 executed, ip = 55eaeca56710
[258600.533102] uprobe ret_handler is executed, ip = 55EAECA57F60
[258600.533111] uprobe handler in PID 43831 executed, ip = 55eaeca56710
[258600.533114] uprobe ret_handler is executed, ip = 55EAECA57A77
sudo ./lkmem -k -c ~/krnl/curr ~/krnl/System.map-5.11.0-34-genericuprobes: 1[0] addr 0xffffa008c309bc00 inode 0xffffa008c12d61a0 ino 1043126 clnts 1 offset 4710 flags 0 consumer[0] at 0xffffffffc0605100 handler: 0xffffffffc0603b13 - lkcd ret_handler: 0xffffffffc0603af3 - lkcd