Memory disclosure via KSM unmap timing

Observable discrepancy in Linux kernel KSM 4.4.0-96.119 and later allows local users to infer victim-page contents through unmap timing. When a candidate page reaches the sharing cap, KSM creates additional physical pages, making MADV_UNMERGEABLE latency reveal whether the victim holds an identical page. The attacker needs a local account or co-resident workload, an exact candidate-page match, active KSM, and max_page_sharing set to 256; the consequence is read-only leakage of matched page contents.