You are mixing "kernel space/user space" with "critical section".
Kernel/User space only defines what kind of privilege does a process possess. If a thread is executing in user space it cannot access the physical memory directly. It has to go through kernel's virtual memory management.
On the other hand, critical section is part of the code that if executed by two processes in parallel could result in data corruption. This would be happening because of the fact that the code is accessing some shared resource.
Those two concept are independent. Critical section can be either in user space or kernel space. Some kind of synchronization is needed inorder for avoiding the corruption of a shared resource. Even in the case where two process/thread are running in kernel mode and want to access a shared resource, they need to apply some sort of synchronization mechanism(spinlocks or mutex).
I hope this explains helps.