In those cases you mentioned the kernel has spawned a process loaded from normal ELF executable from filesystem, just like you could do with exec(). But in this bpfilter_umh case the executable is not coming from the filesystem but instead is embedded in the kernel itself. That seems to be quite new invention.