mm: fix fault vs invalidate race for linear mappings