No, it was not cross address space. Actually the kernel was mapped into the high address space of every process (so it was the same address space) and the kerne

No, it was not cross address space. Actually the kernel was mapped into the high address space of every process (so it was the same address space) and the kernel mapped all of physical memory. So all of physical memory was mapped into every process' logical address space. This was OK because user processes didn't have the privilege to actually read those kernel pages. But Spectre+Meltdown bypassed the privilege enforcement to speculatively read any location and then bled that information back out via a microarchitectural channel. The solution was kernel page table isolation. Don't map the kernel and thus all of physical memory into each process. However, this now has the overhead of mapping and unmapping the kernel pages for each context switch.