Are you thinking rowhammer? My understanding is limited, but doesnt rowhammer require being able to write to memory at a consistent address, co-located with the data being attacked? Im not sure thats doable with tmpfs, but probably worth an investigation by someone more knowledgable than me :)