The reason why you can use Spectre to read kernel memory is that there is a JIT'd runtime in the kernel (BPF). There is no privilege boundary crossing because y

The reason why you can use Spectre to read kernel memory is that there is a JIT'd runtime in the kernel (BPF). There is no privilege boundary crossing because you are effectively running code in the context of the kernel.