Yup, that's what I suspected. The list is corrupted:
Unfortunately we only see that the list is corrupted but not which
code caused it. This looks like something forgot to delete the timer
before freeing the datastructure which contains it.
Can you please enable CONFIG_SLUB_DEBUG=y and CONFIG_SLUB_DEBUG_ON=y
and give it another try?
If we can not catch it that way, I'll whip up a patch which points us
to the code which added the offending timer.