I just tried with Linux master, and the page fault didn’t happen anymore.

    /boot/config-4.18.0-rc8-00004-gfedb8da96355:CONFIG_SLAB_FREELIST_HARDENED=y

Out of curiosity, I’ll try to bisect this.