Public bug reported:
DESCRIPTION:
== Summary ==
Repeated kernel panics on AMD Ryzen 7 4800U (Renoir/Zen2) triggered by the SRSO
(Speculative Return Stack Overflow) mitigation interacting with the scheduler
tick
path. The system crashes every 1-11 days with no user-space trigger. Crashes
occur
in both linux-image-7.0.0-22-generic and linux-image-7.0.0-27-generic.
Workaround: processor.max_cstate=1 (preventing deep C-states avoids the
crash path).
== Hardware ==
- System: AZW (Beelink) SER Mini PC
- CPU: AMD Ryzen 7 4800U with Radeon Graphics (Zen2 / Renoir)
- Microcode: 0x0860010d (updated from 0x08600106 at boot)
- GPU: AMD Renoir [Radeon Vega Series] (integrated, amdgpu driver)
- RAM: 16GB DDR4
- BIOS: SER_V1.14_P3C6M43_B_Link (03/24/2022) — latest available for this model
- NVMe storage
== Software ==
- Ubuntu 26.04 LTS (fresh install on 2026-05-26)
- Kernel: 7.0.0-22-generic and 7.0.0-27-generic (both affected)
- amd64-microcode: 3.20251202.1ubuntu2
- linux-firmware: 20260319.git217ca6e4.1ubuntu
- Boot params: quiet splash crashkernel=...
- Active mitigation: srso_return_thunk (confirmed via dmesg)
- NOPTI active
== Crash #1 — 2026-07-10 (kernel 7.0.0-27) ==
Oops: invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 0 Comm: swapper/0
RIP: 0010:srso_safe_ret+0x0/0x20
Call Trace:
<IRQ>
sched_tick+0x48/0x280
update_process_times+0xa0/0xe0
tick_nohz_handler+0x96/0x1a0
__hrtimer_run_queues+0x10c/0x270
hrtimer_interrupt+0x104/0x250
__sysvec_apic_timer_interrupt+0x58/0x150
sysvec_apic_timer_interrupt+0x9a/0xd0
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1b/0x20
RIP: 0010:cpuidle_enter_state+0xca/0x700
cpuidle_enter+0x30/0x50
cpuidle_idle_call+0x16b/0x1f0
do_idle+0x94/0xf0
</TASK>
== Crash #2 — 2026-07-12 (kernel 7.0.0-27) ==
BUG: unable to handle page fault for address: ffffffff99053b04
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD bc447067 P4D bc447067 PUD bc448063 PMD 0
Oops: Oops: 0002 [#1] SMP NOPTI
CPU: 0 UID: 1000 PID: 2680076 Comm: curl
RIP: 0010:kick_ilb+0x6e/0x180
Call Trace:
<TASK>
kick_ilb+0x52/0x180
nohz_balancer_kick+0x92/0x2d0
sched_balance_trigger+0x4c/0x90
sched_tick+0xf9/0x280
update_process_times+0xa0/0xe0
tick_nohz_handler+0x96/0x1a0
__hrtimer_run_queues+0x10c/0x270
hrtimer_interrupt+0x104/0x250
__sysvec_apic_timer_interrupt+0x58/0x150
sysvec_apic_timer_interrupt+0x44/0xd0
asm_sysvec_apic_timer_interrupt+0x1b/0x20
</TASK>
== Additional context ==
- amdgpu driver logs "dm_irq_work_func [amdgpu] hogged CPU for >13333us" 35+
times
per boot, suggesting IRQ pressure on the scheduler tick path.
- Both crashes occur on CPU 0 during timer interrupt → sched_tick.
- Crash #1 is an invalid opcode in the SRSO safe_ret thunk itself.
- Crash #2 is a page fault in kick_ilb writing to an unmapped kernel address
(PMD 0),
suggesting corrupted per-cpu data or text patching issue in the SRSO path.
- The system was stable for 14 days once (when amdgpu initialized without
errors).
- Full kdump vmcores are available in /var/crash/ for all crashes.
== Crash frequency ==
6+ crashes since 2026-05-29, intervals ranging from 1.5 to 11 days.
No specific user-space trigger identified — crashes happen during idle or light
workloads (cron jobs, curl).
== Workaround ==
Adding processor.max_cstate=1 to kernel boot parameters prevents the CPU from
entering deep C-states where the crash occurs. This confirms the interaction
between cpuidle exit path, SRSO return thunks, and sched_tick.
== Possible root cause ==
The SRSO mitigation (srso_return_thunk / srso_safe_ret) appears to have a bug
in the text patching or in the interaction with the scheduler's nohz/idle
balancer on AMD Zen2 processors when exiting deep C-states. The amdgpu driver
hogging the CPU in interrupt context likely increases the probability of hitting
the race condition.
== Kdump files ==
/var/crash/202607101059/ — Crash #1 (srso_safe_ret)
/var/crash/202607120124/ — Crash #2 (kick_ilb)
Both contain full vmcore dumps and dmesg extracts.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-27-generic 7.0.0-27.27
ProcVersionSignature: Ubuntu 7.0.0-27.27-generic 7.0.6
Uname: Linux 7.0.0-27-generic x86_64
ApportVersion: 2.34.0-0ubuntu2
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: gdm-greeter 2490 F.... wireplumber
/dev/snd/controlC0: gdm-greeter 2490 F.... wireplumber
/dev/snd/seq: gdm-greeter 2474 F.... pipewire
CasperMD5CheckResult: unknown
Date: Sun Jul 12 12:34:59 2026
InstallationDate: Installed on 2026-05-26 (47 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
IwDevWlp2s0Link: Not connected.
MachineType: AZW SER
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=screen-256color
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-27-generic
root=UUID=3cc618bf-7287-4c56-86b6-9ddbfe59a14a ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 03/24/2022
dmi.bios.release: 5.16
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: SER_V1.14_P3C6M43_B_Link
dmi.board.asset.tag: Default string
dmi.board.name: SER
dmi.board.vendor: AZW
dmi.board.version: V01
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 35
dmi.chassis.vendor: AZW
dmi.chassis.version: Default string
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvrSER_V1.14_P3C6M43_B_Link:bd03/24/2022:br5.16:svnAZW:pnSER:pvrDefaultstring:rvnAZW:rnSER:rvrV01:cvnAZW:ct35:cvrDefaultstring:skuSKU4:pfaSER:
dmi.product.family: SER
dmi.product.name: SER
dmi.product.sku: SKU4
dmi.product.version: Default string
dmi.sys.vendor: AZW
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160457
Title:
Kernel panic in srso_safe_ret / kick_ilb during sched_tick on AMD
Ryzen 7 4800U (Zen2)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2160457/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
