There's nothing stopping a userspace program from keeping a bunch of threads around with a custom signal stack in a suspended state with their normal thread stack mprotected to PROT_NONE. OpenJDK seems to do this, for example.