Acutally you're right.
It's a trick to compute the addresses of the fake "struct page" structures on both 32 and 64
bits platforms.
It should work on 64 bits platforms. I don't know why it doesn't in your case though but it's
just a matter of tuning some values in the exploit code probably.
Thanks.