I think they are just using the CR3 register to implement the fix. The actual side channel will be something a bit more esoteric.

Something like this: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-...