vmscan fix mapping use after free