This bug is 100% reproducable running glest (a 3d game). The kernel crashes when glest exit. I have managed to fetch the dmesg by killing glest from at text mode console:

[17191832.408000] kernel BUG at mm/page_alloc.c:1069!
[17191832.408000] invalid operand: 0000 [#1]
[17191832.408000] PREEMPT SMP 
[17191832.408000] Modules linked in: binfmt_misc cpufreq_userspace cpufreq_stats freq_table cpufreq_powersave cpufreq_ondemand cpufreq_conservative video tc1100_wmi sony_acpi pcc_acpi hotkey dev_acpi container button acpi_sbs battery ac i2c_acpi_ec ipv6 sch_ingress cls_u32 sch_sfq sch_cbq md_mod dm_mod loop af_packet snd_ens1371 gameport snd_rawmidi snd_seq_device snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd floppy pcspkr nvidia via686a i2c_isa i2c_viapro i2c_core psmouse serio_raw soundcore snd_page_alloc snd_ac97_bus parport_pc parport 3c59x via_agp agpgart shpchp pci_hotplug mii evdev tsdev ext3 jbd usbhid ide_generic uhci_hcd usbcore pdc202xx_old ide_cd cdrom ide_disk via82cxxx generic thermal processor fan capability commoncap vga16fb vgastate fbcon tileblit font bitblit softcursor
[17191832.408000] CPU:    0
[17191832.408000] EIP:    0060:[<c0154c6a>]    Tainted: P S  B VLI
[17191832.408000] EFLAGS: 00010212   (2.6.15-27-k7) 
[17191832.408000] EIP is at free_pages+0x2a/0x40
[17191832.408000] eax: 0000666e   ebx: d2f6e5a0   ecx: 00040006   edx: 00000000
[17191832.408000] esi: 0000000c   edi: 00000003   ebp: c97fe468   esp: d2429c1c
[17191832.408000] ds: 007b   es: 007b   ss: 0068
[17191832.408000] Process glest.bin (pid: 4847, threadinfo=d2428000 task=d372f580)
[17191832.408000] Stack: e1010f6f 00000000 e103e3d4 00000200 d2f6e5a0 e119e700 00000200 00000000 
[17191832.408000]        e101432f e119e700 d2f6e5a0 00000001 00000200 00000000 00000000 00000200 
[17191832.408000]        d2429cac e0e030aa e119e700 cf1d79f0 00000200 00000000 00000000 beef0003 
[17191832.408000] Call Trace:
[17191832.408000]  [<e1010f6f>] nv_vm_free_pages+0xa9/0x10a [nvidia]
[17191832.408000]  [<e101432f>] nv_free_pages+0x290/0x2ae [nvidia]
[17191832.408000]  [<e0e030aa>] _nv001716rm+0x4e/0x58 [nvidia]
[17191832.408000]  [<e0e03089>] _nv001716rm+0x2d/0x58 [nvidia]
[17191832.408000]  [<e0de116b>] _nv007631rm+0x13/0x34 [nvidia]
[17191832.408000]  [<e0dead7e>] _nv001239rm+0x1c6/0x1e0 [nvidia]
[17191832.408000]  [<e0deba4b>] _nv001228rm+0x8b/0x9c [nvidia]
[17191832.408000]  [<e0deab3d>] _nv001241rm+0xa5/0x120 [nvidia]
[17191832.408000]  [<e0f23668>] _nv004169rm+0x88/0x94 [nvidia]
[17191832.408000]  [<e0dea875>] _nv001246rm+0x3d/0x260 [nvidia]
[17191832.408000]  [<e0e096e6>] rm_disable_interrupts+0x42/0x54 [nvidia]
[17191832.408000]  [<e0e02a33>] _nv001672rm+0x1b/0x20 [nvidia]
[17191832.408000]  [<e0e08993>] _nv001226rm+0x67/0x98 [nvidia]
[17191832.408000]  [<e0e08985>] _nv001226rm+0x59/0x98 [nvidia]
[17191832.408000]  [<e0e02ef6>] _nv001740rm+0x12/0x18 [nvidia]
[17191832.408000]  [<e0e09bea>] rm_free_unused_clients+0x2e/0x88 [nvidia]
[17191832.408000]  [<e0e09c22>] rm_free_unused_clients+0x66/0x88 [nvidia]
[17191832.408000]  [<e0e09c0e>] rm_free_unused_clients+0x52/0x88 [nvidia]
[17191832.408000]  [<e1013313>] nv_kern_ctl_close+0x6f/0x90 [nvidia]
[17191832.408000]  [<e10121c7>] nv_kern_close+0xf4/0x1da [nvidia]
[17191832.408000]  [<c018cb22>] dput+0xf2/0x210
[17191832.408000]  [<c01736b9>] __fput+0xa9/0x1a0
[17191832.408000]  [<c0171a52>] filp_close+0x52/0x90
[17191832.408000]  [<c0126e61>] put_files_struct+0x91/0xe0
[17191832.408000]  [<c0127c31>] do_exit+0x111/0x420
[17191832.408000]  [<c0127fc0>] do_group_exit+0x40/0xb0
[17191832.408000]  [<c01327f7>] get_signal_to_deliver+0x227/0x340
[17191832.408000]  [<c01031df>] do_signal+0x6f/0x180
[17191832.408000]  [<c013c690>] autoremove_wake_function+0x0/0x60
[17191832.408000]  [<c01727f8>] vfs_write+0x1a8/0x1b0
[17191832.408000]  [<c01728f2>] sys_write+0x72/0x80
[17191832.408000]  [<c0103318>] do_notify_resume+0x28/0x38
[17191832.408000]  [<c01034e2>] work_notifysig+0x13/0x19
[17191832.408000] Code: 00 85 c0 75 02 f3 c3 8d 88 00 00 00 40 c1 e9 0c 3b 0d 40 89 43 c0 73 13 89 c8 c1 e0 05 8d 04 88 03 05 50 89 43 c0 e9 76 ff ff ff <0f> 0b 2d 04 9c 19 32 c0 eb e3 8d b6 00 00 00 00 8d bf 00 00 00 
[17191832.408000]  <1>Fixing recursive fault but reboot is needed!


Linux dolores 2.6.15-27-k7 #1 SMP PREEMPT Sat Sep 16 02:35:20 UTC 2006 i686 GNU/Linux
server glx vendor string: NVIDIA Corporation
server glx version string: 1.3
OpenGL vendor string: NVIDIA Corporation
OpenGL renderer string: GeForce2 MX/PCI/3DNOW!
OpenGL version string: 1.5.3 NVIDIA 71.74
nVidia Corporation NV11 [GeForce2 MX/MX 400] (rev a1) (prog-if 00 [VGA])
linux-restricted-modules 2.6.15.25