I have been searching this question for hours but can not find a simple yes or no answer (or maybe depends on OS or architecture), which is what I am looking for. This probably might be a very trivial question.
My hunch is that environment variables of a process are in the kernel space and hence are kernel data structures and live right above the process image in the virtual address space.
Why would you think the environment is stored in the kernel?
That would require a dedicated syscall to export it OR a shared memory area mapped into the process. But the process can modify it's own environment, so what happens now? It is trivial to check that the environment is initially stored on the stack alongside argv.
Similarly, why would you google around instead of checking the implementation. For instance, there is /proc/PID/environ and checking that clearly shows it is being read from the target process' address space. https://elixir.bootlin.com/linux/v4.13.16/source/fs/proc/base.c#L908