Linux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oops#tmpfs
tmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexec