To be fair, there's nothing that says the higher half _has_ to be entirely kernel mode. Only that bits 63 through 48 have to be the same value.

And Intel has a spec out for a PML5 page table, giving you 57 total virtual address bits.