I think this is possibly the xen PV side of the fix. Linux' PTI mitigation isn't enabled for paravirt xen:
if (hypervisor_is_type(X86_HYPER_XEN_PV)) {
pti_print_if_insecure("disabled on XEN PV.");
return;
}