Their PoC does as you say, but is built upon arbitrary modification of the page cache, which could be abused for the other things

Ah indeed, it can be used to overwrite the page cache for files on read-only volumes.