I think the threat model is a buggy kernel - or a kernel insuffiently hardened against buggy processors with speculative execution side channels - with a malici

I think the threat model is a buggy kernel - or a kernel insuffiently hardened against buggy processors with speculative execution side channels - with a malicious process. E.g. if syscall S reads kernel memory without properly checking pointers/offsets (maybe GCC optimized them out), then process A can possibly use that to steal process B's secrets. Or maybe the kernel does check the pointers/offsets, but isn't hardened against yet another speculative execution side channel attack your processor is vulnerable to, so leaks some information via timing information. MAP_EXCLUSIVE breaks that exploit, and to unbreak it you need both syscall S and another buggy syscall (or maybe another row hammer attack) - to write kernel memory - and to successfully leverage that into tricking the kernel into remapping process B's pages. No panacea, but I could see it rasing the bar in exploit difficulty as part of a defense in depth strategy.