https://gruss.cc/files/kaiser.pdf

ARMに攻撃は通用しない

Similar translation tables exist on modern ARM (Cortex-A) processors too,
with small differences in size and property bits. One significant difference to
x86-64 is that ARM CPUs have two registers to store physical addresses of
translation tables (TTBR0 and TTBR1). Typically, one is used to map the user
address space (lower half) whereas the other is used to map the kernel address
space (upper half). Gruss et al. [6] speculated that this might be one of the
reasons why the attack does not work on ARM processors. As x86-64 has only ← ★
one translation-table register (CR3), it is used for both user and kernel address
space. Consequently, to perform privilege checks upon a memory access, the
actual page translation tables have to be checked.

ARMは、
ユーザーの仮想アドレスと
カーネルの仮想アドレスは
違うレジスタに格納する仕様になってる