Kernel Oops - BUG: unable to handle kernel NULL pointer dereference at 00000008; EIP is at fb_release+0x25/0x60

This bug may be the underlying problem of bug 605124, which I have reported upstream as https://bugs.freedesktop.org/show_bug.cgi?id=29048 . I had written some more relevant information here, but I was struck by bug 553946 for the second time today, and can't remember what it was :-(

I have tried several kernels, but it is hard to say anything for sure, since the frequency of this problem varies with kernel build and possibly the mood of ureadahead (i.e. how fast it is able to make the boot go).

2.6.35-7: Where I initially had the problem. Sometimes I only get this oops message in the dmesg output and everything else works fine, but often I get an the oops from bug 605124 and Xorg starts in low-graphics mode.
2.6.35-6: I have had this oops once now with this kernel. See comment #2.
2.6.35-rc5 (mainline build): I get this oops every now and then, but it does not affect Xorg or anything else as far as I can see.
2.6.35-rc4 (mainline build): I get this oops every now and then, but it does not affect Xorg or anything else as far as I can see. The laptop keyboard and pointer does not work with this build, but USB mouse and keyboard does.
2.6.35-rc3 (mainline build): I have tried to trigger the problem here several times without success. ureadahead sayd it would reprofile on next boot when I installed this, but it always returned exit status 5 on boot with this kernel, which may mean the boots were slower.
2010-06-15 mainline build: I have tried to trigger the problem here several times without success, but I alternated with -rc5 for comparison and in 8 boots on each, none of them had problems.
2010-06-30 mainline build: Like -rc4, laptop keyboard doesn't work and at this time I didn't have an external keyboard available.

ProblemType: KernelOops
DistroRelease: Ubuntu 10.10
Package: linux-image-2.6.35-7-generic 2.6.35-7.12
Regression: Yes
Reproducible: No
ProcVersionSignature: Ubuntu 2.6.35-7.12-generic 2.6.35-rc4
Uname: Linux 2.6.35-7-generic i686
AcpiTables: Error: [Errno 13] Permission denied
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.23.
Annotation: Your system might become unstable now and might need to be restarted.
Architecture: i386
ArecordDevices:
 **** List of CAPTURE Hardware Devices ****
 card 0: Intel [HDA Intel], device 0: AD198x Analog [AD198x Analog]
   Subdevices: 2/2
   Subdevice #0: subdevice #0
   Subdevice #1: subdevice #1
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: gom 1456 F.... pulseaudio
CRDA: Error: [Errno 2] No such file or directory
Card0.Amixer.info:
 Card hw:0 'Intel'/'HDA Intel at 0xf8220000 irq 46'
   Mixer name : 'Analog Devices AD1984'
   Components : 'HDA:11d41984,17aa20dd,00100400'
   Controls : 31
   Simple ctrls : 19
Card29.Amixer.info:
 Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30, fw 7RHT16WW-1.02'
   Mixer name : 'ThinkPad EC 7RHT16WW-1.02'
   Components : ''
   Controls : 1
   Simple ctrls : 1
Card29.Amixer.values:
 Simple mixer control 'Console',0
   Capabilities: pswitch pswitch-joined penum
   Playback channels: Mono
   Mono: Playback [on]
Date: Wed Jul 14 15:45:18 2010
Failure: oops
Frequency: Once a day.
HibernationDevice: RESUME=UUID=e938f4f3-2a95-49cf-96c1-b8bda2c16dce
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Alpha i386 (20100630.2)
MachineType: LENOVO 7764CTO
PccardctlIdent:
 Socket 0:
   no product info available
PccardctlStatus:
 Socket 0:
   no card
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.35-7-generic root=UUID=460f28a3-969c-409a-ab57-6070e2c7288e ro quiet splash
RelatedPackageVersions: linux-firmware 1.37
RfKill:
 0: phy0: Wireless LAN
  Soft blocked: no
  Hard blocked: no
SourcePackage: linux
Title: BUG: unable to handle kernel NULL pointer dereference at 00000008
dmi.bios.date: 11/27/2008
dmi.bios.vendor: LENOVO
dmi.bios.version: 7SET36WW (1.22 )
dmi.board.name: 7764CTO
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr7SET36WW(1.22):bd11/27/2008:svnLENOVO:pn7764CTO:pvrThinkPadX61Tablet:rvnLENOVO:rn7764CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 7764CTO
dmi.product.version: ThinkPad X61 Tablet
dmi.sys.vendor: LENOVO