And QubesOS isnt based on linux kernel. It uses Xen. Linux is used in the Qubes aka VMs.
The dom0 is very much running a Linux kernel, the same way your domU:s are typically running Linux kernels (although you could probably run any kernel in hvm mode).
As an example, here is the documentation on how to manage updates for the dom0 kernel:
https://www.qubes-os.org/doc/how-to-install-software-in-dom0/#kernel-upgrade
CPU vulnerability mitigations would typically be distributed with the
intel-microcode
package for Intel processors on Debian-based distributions, for example.