About 20y ago, as an evolution from the userland defenses, PaX started on the kernel self-protection journey with KERNEXEC. NX kernel pages on i386 (using segmentation, no actual NX bit then), some read-only kernel data, etc. Still riding high :).