The RAM manufacturers, for building their circuits too small? Or Intel, for allowing a side-channel attack to exist? Or Linux, for assuming that randomizing some pointers would mitigate any side-channel? This bug is definitely a product of lots of different issues coming together.
We do not know the details about the bug, it may not be the RAM chips but from the AMD dev commit it seems that Intel CPUs perform some insecure optimizations.