Addressing Meltdown and Spectre in the kernel

Thankfully, Linux can update microcode independently of your BIOS. It's typically built into your initramfs, and one of the very first things the kernel does as it boots is to upload the new microcode to the CPU. If so, it comes from your package repository (apt/yum/pacman/whatever) like any other package, and all you need to worry about is to have a system in place for automatically patching those and booting every now and then.

The microcode is obviously a non-free component, but most people will be willing to make that sacrifice.