Based on my (limited) understanding if I were to disable udev, the userspace should not be able to enumerate/interact with any newly connected device since udev handles uevents generated by kernel. (right?) So as a test, I disabled systemd-udevd and then plugged in a flash drive. I disabled support for usb mass storage in the kernel. So 'lsblk' didn't show the device, just as expected. However, 'lsusb' still dynamically updates the list as I repeatedly plugin and remove a flash drive. Then I studied libusb/lsusb code for a bit. It seems that lsusb makes use of 'libusb_get_device_list()' to find the connected usb devices. But I couldn't find any detail regarding implementation of libusb_get_device_list. I am sure I'm missing something. Could someone please help me understand what is happening behind the scenes? Regards.