Public bug reported:
A kernel NULL pointer dereference occurs in the rtw89_core module when
triggering a Wi-Fi scan offload on a Realtek RTL8922AE adapter
(`rtw89_8922ae 0000:03:00.0: rtw89_hw_scan_offload failed ret -110`).
When wpa_supplicant triggers a scan via nl80211,
rtw89_fw_h2c_scan_offload_be attempts to access an invalid memory
address (0x0000000000000070). The process exits with IRQs disabled,
rendering the network subsystem unstable and eventually causing the
display server/compositor to become unresponsive. A subsequent attempt
to suspend the machine (s2idle on lid close) times out while freezing
user.slice, requiring a forced reboot via SysRq.
System Environment:
* OS: Ubuntu
* Kernel: 7.0.0-28-generic (#28-Ubuntu SMP PREEMPT_DYNAMIC)
* Hardware: Lenovo IdeaPad Slim 5 laptop (Lenovo 83NJ / LNVNB161216)
* Wireless Chipset: Realtek RTL8922AE (rtw89_8922ae / rtw89_pci / rtw89_core)
Kernel Oops / Call Trace:
BUG: kernel NULL pointer dereference, address: 0000000000000070
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 2384 Comm: wpa_supplicant Tainted: G W
7.0.0-28-generic #28-Ubuntu
Hardware name: LENOVO 83NJ/LNVNB161216, BIOS R0CN22WW 07/12/2025
RIP: 0010:rtw89_fw_h2c_scan_offload_be+0x27d/0x930 [rtw89_core]
Code: c1 e8 14 c1 e0 10 09 c1 89 4a 10 8b 43 24 89 42 14 48 8b 43 10 89 42 18
8b 43 14 89 42 1c 45 84 ed 75 20 48 8b 85 38 ff ff ff <44> 0f b6 68 70 41 80 fd
01 0f 87 78 5f 05 00 41 83 e5 01 0f 85 c5
RSP: 0018:ffffcd2083423248 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffcd2083423368 RCX: 000000000000ffff
RDX: ffff88b4122960a0 RSI: ffff88b4074e2818 RDI: 0000000000000000
RBP: ffffcd2083423338 R08: 0000000000000000 R09: ffff88b44d0820f8
R10: ffff88b44d0820a0 R11: 0000000000000000 R12: 0000000000000028
R13: 0000000000000000 R14: 00000000ffffffff R15: 00000001d8417b1a
FS: 000074693c02c880(0000) GS:ffff88b7a27ff000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000070 CR3: 00000001439e9000 CR4: 0000000000f50ef0
PKRU: 55555554
Call Trace:
<TASK>
? psi_task_switch+0x12a/0x390
ieee80211_request_scan+0xe/0x20 [mac80211]
ieee80211_scan+0x123/0x190 [mac80211]
rdev_scan+0x43/0x160 [cfg80211]
? __kmalloc_noprof+0x1f8/0x5f0
cfg80211_scan+0x127/0x170 [cfg80211]
nl80211_trigger_scan+0x58e/0xa90 [cfg80211]
genl_family_rcv_msg_doit+0x120/0x190
genl_family_rcv_msg+0x174/0x230
genl_rcv_msg+0x4c/0xb0
netlink_rcv_skb+0x61/0x120
genl_rcv+0x28/0x50
netlink_unicast+0x28f/0x3c0
netlink_sendmsg+0x216/0x450
____sys_sendmsg+0x35a/0x380
___sys_sendmsg+0x99/0xf0
__sys_sendmsg+0x93/0x100
__x64_sys_sendmsg+0x1d/0x30
do_syscall_64+0x105/0x5a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
note: wpa_supplicant[2384] exited with irqs disabled
Steps to Reproduce:
1. Use a Wi-Fi 7 device driven by rtw89_8922ae under normal wireless operations.
2. Allow wpa_supplicant / NetworkManager to trigger periodic background network
scans.
3. The driver experiences a kernel Oops during rtw89_fw_h2c_scan_offload_be
execution.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-28-generic 7.0.0-28.28
ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Mon Aug 3 09:54:07 2026
InstallationDate: Installed on 2026-02-10 (174 days ago)
InstallationMedia: Ubuntu 24.04.3 LTS "Noble Numbat" - Release amd64
(20250805.1)
MachineType: LENOVO 83NJ
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/usr/bin/fish
TERM=xterm-ghostty
XDG_RUNTIME_DIR=<set>
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: Upgraded to resolute on 2026-05-06 (89 days ago)
dmi.bios.date: 07/12/2025
dmi.bios.release: 1.22
dmi.bios.vendor: LENOVO
dmi.bios.version: R0CN22WW
dmi.board.asset.tag: NO Asset Tag
dmi.board.name: LNVNB161216
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T76574 WIN
dmi.chassis.asset.tag: NO Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: IdeaPad Slim 5 14AKP10
dmi.ec.firmware.release: 1.22
dmi.modalias:
dmi:bvnLENOVO:bvrR0CN22WW:bd07/12/2025:br1.22:efr1.22:svnLENOVO:pn83NJ:pvrIdeaPadSlim514AKP10:rvnLENOVO:rnLNVNB161216:rvrSDK0T76574WIN:cvnLENOVO:ct10:cvrIdeaPadSlim514AKP10:skuLENOVO_MT_83NJ_BU_idea_FM_IdeaPadSlim514AKP10:pfaIdeaPadSlim514AKP10:
dmi.product.family: IdeaPad Slim 5 14AKP10
dmi.product.name: 83NJ
dmi.product.sku: LENOVO_MT_83NJ_BU_idea_FM_IdeaPad Slim 5 14AKP10
dmi.product.version: IdeaPad Slim 5 14AKP10
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162739
Title:
[rtw89] Kernel NULL pointer dereference in
rtw89_fw_h2c_scan_offload_be on RTL8922AE
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162739/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
