I just encountered the same bug, once with 2.6.22-13 and once with 2.6.22-14.  Here is a copy of syslog :

Oct 11 20:43:19 nec kernel: [29991.443174] Eeek! page_mapcount(page) went negative! (-1)
Oct 11 20:43:19 nec kernel: [29991.443196]   page pfn = 2ece0
Oct 11 20:43:19 nec kernel: [29991.443200]   page->flags = 40000824
Oct 11 20:43:19 nec kernel: [29991.443203]   page->count = 2
Oct 11 20:43:19 nec kernel: [29991.443206]   page->mapping = effe4654
Oct 11 20:43:19 nec kernel: [29991.443223]   vma->vm_ops = generic_file_vm_ops+0x0/0x18
Oct 11 20:43:19 nec kernel: [29991.443237]   vma->vm_ops->nopage = filemap_nopage+0x0/0x340
Oct 11 20:43:19 nec kernel: [29991.443243]   vma->vm_file->f_op->mmap = generic_file_mmap+0x0/0x40
Oct 11 20:43:19 nec kernel: [29991.443313] ------------[ cut here ]------------
Oct 11 20:43:19 nec kernel: [29991.443316] kernel BUG at /build/buildd/linux-source-2.6.22-2.6.22/mm/rmap.c:628!
Oct 11 20:43:19 nec kernel: [29991.443321] invalid opcode: 0000 [#1]
Oct 11 20:43:19 nec kernel: [29991.443324] SMP 
Oct 11 20:43:19 nec kernel: [29991.443328] Modules linked in: vmnet(P) vmmon(P) binfmt_misc rfcomm l2cap bluetooth ppdev r128 drm cpufreq_stats cpufreq_ondemand cpufreq_powersave cpufreq_conservative cpufreq_userspace ac button container dock sbs video battery parport_pc lp parport p4_clockmod speedstep_lib freq_table snd_via82xx gameport snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_mpu401_uart snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device i2c_viapro i2c_core via_ircc snd pcspkr psmouse serio_raw soundcore via_agp irda shpchp pci_hotplug agpgart crc_ccitt ipv6 nls_cp437 nls_utf8 cifs evdev ext3 jbd mbcache ide_cd cdrom ide_disk ata_generic libata scsi_mod via_rhine mii floppy via82cxxx ide_core uhci_hcd usbcore thermal processor fan fuse apparmor commoncap
Oct 11 20:43:19 nec kernel: [29991.443438] CPU:    0
Oct 11 20:43:19 nec kernel: [29991.443439] EIP:    0060:[page_remove_rmap+233/256]    Tainted: P       VLI
Oct 11 20:43:19 nec kernel: [29991.443441] EFLAGS: 00213282   (2.6.22-14-generic #1)
Oct 11 20:43:19 nec kernel: [29991.443452] EIP is at page_remove_rmap+0xe9/0x100
Oct 11 20:43:19 nec kernel: [29991.443457] eax: 0000004a   ebx: c15d9c00   ecx: 00203046   edx: 00000000
Oct 11 20:43:19 nec kernel: [29991.443462] esi: dfe0b8f0   edi: b7d71000   ebp: dfeda380   esp: df941dc8
Oct 11 20:43:19 nec kernel: [29991.443466] ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
Oct 11 20:43:19 nec kernel: [29991.443471] Process Xorg (pid: 4493, ti=df940000 task=dfacc530 task.ti=df940000)
Oct 11 20:43:19 nec kernel: [29991.443475] Stack: c037ae8d effe4654 c15d9c00 ef1465c4 c016b5c2 c019e13c 2ece0025 3882d12b 
Oct 11 20:43:19 nec kernel: [29991.443487]        b7ea4fff 00000000 dfe0b8f0 df941e5c 001dff20 00000000 00000001 b7ea5000 
Oct 11 20:43:19 nec kernel: [29991.443499]        dfab9b7c c16092c0 0000a6df 00000000 00000000 ffffffef c15e28cc 00000000 
Oct 11 20:43:19 nec kernel: [29991.443510] Call Trace:
Oct 11 20:43:19 nec kernel: [29991.443528]  [unmap_vmas+770/1488] unmap_vmas+0x302/0x5d0
Oct 11 20:43:19 nec kernel: [29991.443535]  [__mark_inode_dirty+92/400] __mark_inode_dirty+0x5c/0x190
Oct 11 20:43:19 nec kernel: [29991.443633]  [exit_mmap+120/240] exit_mmap+0x78/0xf0
Oct 11 20:43:19 nec kernel: [29991.443667]  [mmput+56/160] mmput+0x38/0xa0
Oct 11 20:43:19 nec kernel: [29991.443682]  [do_exit+271/2064] do_exit+0x10f/0x810
Oct 11 20:43:19 nec kernel: [29991.443746]  [do_group_exit+38/128] do_group_exit+0x26/0x80
Oct 11 20:43:19 nec kernel: [29991.443762]  [get_signal_to_deliver+664/1040] get_signal_to_deliver+0x298/0x410
Oct 11 20:43:19 nec kernel: [29991.443789]  [do_page_fault+0/1680] do_page_fault+0x0/0x690
Oct 11 20:43:19 nec kernel: [29991.443805]  [do_notify_resume+147/1824] do_notify_resume+0x93/0x720
Oct 11 20:43:19 nec kernel: [29991.443877]  [<f0ca8f17>] drm_vbl_send_signals+0x17/0xe0 [drm]
Oct 11 20:43:19 nec kernel: [29991.443926]  [atomic_notifier_call_chain+23/32] atomic_notifier_call_chain+0x17/0x20
Oct 11 20:43:19 nec kernel: [29991.443940]  [do_page_fault+1011/1680] do_page_fault+0x3f3/0x690
Oct 11 20:43:19 nec kernel: [29991.443950]  [handle_IRQ_event+48/96] handle_IRQ_event+0x30/0x60
Oct 11 20:43:19 nec kernel: [29991.443963]  [enable_8259A_irq+13/80] enable_8259A_irq+0xd/0x50
Oct 11 20:43:19 nec kernel: [29991.444011]  [do_page_fault+0/1680] do_page_fault+0x0/0x690
Oct 11 20:43:19 nec kernel: [29991.444021]  [work_notifysig+19/37] work_notifysig+0x13/0x25
Oct 11 20:43:19 nec kernel: [29991.444088]  =======================
Oct 11 20:43:19 nec kernel: [29991.444091] Code: c0 74 0d 8b 50 08 b8 88 9e 37 c0 e8 12 ad fd ff 8b 46 48 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 a8 9e 37 c0 e8 f7 ac fd ff <0f> 0b eb fe 8b 53 0c eb 95 8d b4 26 00 00 00 00 8d bc 27 00 00 
Oct 11 20:43:19 nec kernel: [29991.444152] EIP: [page_remove_rmap+233/256] page_remove_rmap+0xe9/0x100 SS:ESP 0068:df941dc8
Oct 11 20:43:19 nec kernel: [29991.444165] Fixing recursive fault but reboot is needed!
Oct 11 20:43:19 nec kernel: [29991.444183] BUG: scheduling while atomic: Xorg/0x00000001/4493
Oct 11 20:43:19 nec kernel: [29991.444191]  [schedule+1243/2192] schedule+0x4db/0x890
Oct 11 20:43:19 nec kernel: [29991.444218]  [__slab_free+273/672] __slab_free+0x111/0x2a0
Oct 11 20:43:19 nec kernel: [29991.444260]  [cfq_free_io_context+41/160] cfq_free_io_context+0x29/0xa0
Oct 11 20:43:19 nec kernel: [29991.444301]  [do_exit+1896/2064] do_exit+0x768/0x810
Oct 11 20:43:19 nec kernel: [29991.444361]  [die+607/608] die+0x25f/0x260
Oct 11 20:43:19 nec kernel: [29991.444388]  [do_invalid_op+0/144] do_invalid_op+0x0/0x90
Oct 11 20:43:19 nec kernel: [29991.444397]  [do_invalid_op+129/144] do_invalid_op+0x81/0x90
Oct 11 20:43:19 nec kernel: [29991.444427]  [page_remove_rmap+233/256] page_remove_rmap+0xe9/0x100
Oct 11 20:43:19 nec kernel: [29991.444438]  [__call_console_drivers+83/96] __call_console_drivers+0x53/0x60
Oct 11 20:43:19 nec kernel: [29991.444458]  [release_console_sem+455/496] release_console_sem+0x1c7/0x1f0
Oct 11 20:43:19 nec kernel: [29991.444542]  [error_code+114/128] error_code+0x72/0x80
Oct 11 20:43:19 nec kernel: [29991.444584]  [page_remove_rmap+233/256] page_remove_rmap+0xe9/0x100
Oct 11 20:43:19 nec kernel: [29991.444611]  [unmap_vmas+770/1488] unmap_vmas+0x302/0x5d0
Oct 11 20:43:19 nec kernel: [29991.444618]  [__mark_inode_dirty+92/400] __mark_inode_dirty+0x5c/0x190
Oct 11 20:43:19 nec kernel: [29991.444711]  [exit_mmap+120/240] exit_mmap+0x78/0xf0
Oct 11 20:43:19 nec kernel: [29991.444745]  [mmput+56/160] mmput+0x38/0xa0
Oct 11 20:43:19 nec kernel: [29991.444757]  [do_exit+271/2064] do_exit+0x10f/0x810
Oct 11 20:43:19 nec kernel: [29991.444817]  [do_group_exit+38/128] do_group_exit+0x26/0x80
Oct 11 20:43:19 nec kernel: [29991.444834]  [get_signal_to_deliver+664/1040] get_signal_to_deliver+0x298/0x410
Oct 11 20:43:19 nec kernel: [29991.444859]  [do_page_fault+0/1680] do_page_fault+0x0/0x690
Oct 11 20:43:19 nec kernel: [29991.444870]  [do_notify_resume+147/1824] do_notify_resume+0x93/0x720
Oct 11 20:43:19 nec kernel: [29991.444940]  [<f0ca8f17>] drm_vbl_send_signals+0x17/0xe0 [drm]
Oct 11 20:43:19 nec kernel: [29991.444975]  [atomic_notifier_call_chain+23/32] atomic_notifier_call_chain+0x17/0x20
Oct 11 20:43:19 nec kernel: [29991.444989]  [do_page_fault+1011/1680] do_page_fault+0x3f3/0x690
Oct 11 20:43:19 nec kernel: [29991.444999]  [handle_IRQ_event+48/96] handle_IRQ_event+0x30/0x60
Oct 11 20:43:19 nec kernel: [29991.445013]  [enable_8259A_irq+13/80] enable_8259A_irq+0xd/0x50
Oct 11 20:43:19 nec kernel: [29991.445060]  [do_page_fault+0/1680] do_page_fault+0x0/0x690
Oct 11 20:43:19 nec kernel: [29991.445070]  [work_notifysig+19/37] work_notifysig+0x13/0x25
Oct 11 20:43:19 nec kernel: [29991.445136]  =======================
Oct 11 20:45:37 nec syslogd 1.4.1#21ubuntu3: restart.
Oct 11 20:45:37 nec kernel: Inspecting /boot/System.map-2.6.22-14-generic
Oct 11 20:45:38 nec kernel: Loaded 25445 symbols from /boot/System.map-2.6.22-14-generic.
Oct 11 20:45:38 nec kernel: Symbols match kernel version 2.6.22.
Oct 11 20:45:38 nec kernel: No module symbols loaded - kernel modules not enabled. 
Oct 11 20:45:38 nec kernel: [    0.000000] Linux version 2.6.22-14-generic (buildd@vernadsky) (gcc version 4.1.3 20070929 (prerelease) (Ubuntu 4.1.2-16ubuntu2)) #1 SMP Wed Oct 10 06:00:47 GMT 2007 (Ubuntu 2.6.22-14.43-generic)