Public bug reported:
== Summary ==
Bluetooth is non-functional on 6.8.0-139-generic. It works correctly on
6.8.0-138-generic with identical firmware (linux-firmware-mediatek
20240318.git3b128b60-0ubuntu3.1). This is a kernel regression.
== Hardware ==
CyberPowerPC GamingPC, Z890 MAX GAMING WIFI7, BIOS 3002 01/29/2026
Bluetooth adapter: IMC Networks / MediaTek MT7925
USB ID: 13d3:3602
Bus 001 Device 006, Port 014, interfaces 0+1 bound to btusb
== Kernel versions ==
Broken: 6.8.0-139-generic #139-Ubuntu
Working: 6.8.0-138-generic #138-Ubuntu
== Firmware ==
linux-firmware: 20240318.git3b128b60-0ubuntu3.1
linux-firmware-mediatek: 20240318.git3b128b60-0ubuntu3.1
/lib/firmware/mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin.zst
Firmware is present and loads successfully (confirmed by reaching
btmtk_setup_firmware_79xx before the crash).
Firmware package is NOT the cause -- same firmware works on 6.8.0-138.
== Symptom ==
- rfkill lists hci0 with no soft or hard block
- bluetoothctl list returns empty
- Bluetooth toggle in GNOME Settings is non-functional
- btusb module loaded but use count is 0
== Kernel oops (from journalctl -k -b 0) ==
Sep 04 09:21:35 kernel: Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time:
20260605184935
Sep 04 09:21:35 kernel: BUG: kernel NULL pointer dereference, address:
0000000000000219
Sep 04 09:21:35 kernel: #PF: supervisor read access in kernel mode
Sep 04 09:21:35 kernel: #PF: error_code(0x0000) - not-present page
Sep 04 09:21:35 kernel: PGD 0 P4D 0
Sep 04 09:21:35 kernel: Oops: 0000 [#1] PREEMPT SMP NOPTI
Sep 04 09:21:35 kernel: CPU: 23 PID: 260 Comm: kworker/u73:0 Not tainted
6.8.0-139-generic #139-Ubuntu
Sep 04 09:21:35 kernel: Hardware name: CyberPowerPC GamingPC/Z890 MAX GAMING
WIFI7, BIOS 3002 01/29/2026
Sep 04 09:21:35 kernel: Workqueue: hci0 hci_power_on [bluetooth]
Sep 04 09:21:35 kernel: RIP: 0010:__pm_runtime_resume+0x1b/0x80
Sep 04 09:21:35 kernel: RAX: ffff8e8e526a94d0 RBX: 0000000000000050 RCX:
0000000000000000
Sep 04 09:21:35 kernel: RDX: 0000000000000035 RSI: 0000000000000000 RDI:
0000000000000050
Sep 04 09:21:35 kernel: RBP: ffffd2adc0b83b50 R08: 0000000000000000 R09:
0000000000000000
Sep 04 09:21:35 kernel: R10: 0000000000000000 R11: 0000000000000000 R12:
0000000000000004
Sep 04 09:21:35 kernel: R13: 0000000000000035 R14: 000000000000003a R15:
ffffd2adc0b83be8
Sep 04 09:21:35 kernel: CR2: 0000000000000219
Sep 04 09:21:35 kernel: Call Trace:
Sep 04 09:21:35 kernel: <TASK>
Sep 04 09:21:35 kernel: usb_autopm_get_interface+0x1d/0x60
Sep 04 09:21:35 kernel: btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
Sep 04 09:21:35 kernel: btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk]
Sep 04 09:21:35 kernel: btusb_mtk_setup+0x453/0x610 [btusb]
Sep 04 09:21:35 kernel: hci_dev_setup_sync+0x6c/0x430 [bluetooth]
Sep 04 09:21:35 kernel: hci_dev_init_sync+0x3e/0x1c0 [bluetooth]
Sep 04 09:21:35 kernel: hci_dev_open_sync+0xb1/0x350 [bluetooth]
Sep 04 09:21:35 kernel: hci_dev_do_open+0x28/0x70 [bluetooth]
Sep 04 09:21:35 kernel: hci_power_on+0x50/0x210 [bluetooth]
Sep 04 09:21:35 kernel: process_one_work+0x181/0x3a0
Sep 04 09:21:35 kernel: worker_thread+0x18b/0x330
Sep 04 09:21:35 kernel: kthread+0xef/0x120
Sep 04 09:21:35 kernel: ret_from_fork+0x44/0x70
== Analysis ==
usb_autopm_get_interface() passes &intf->dev to __pm_runtime_resume().
RDI=0x50 is the offset of struct device inside struct usb_interface, meaning
intf itself was NULL. The crash address 0x219 = 0x50 + 0x1c9, which is the
power state flag read inside __pm_runtime_resume. This is a NULL dereference
on the USB interface pointer in btmtk_usb_hci_wmt_sync, caused by the
interface pointer not being set before the WMT firmware handshake begins.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-139-generic 6.8.0-139.139
ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12
Uname: Linux 6.8.0-139-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: pm 3415 F.... wireplumber
/dev/snd/controlC0: pm 3415 F.... wireplumber
/dev/snd/seq: pm 3413 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Sat Sep 5 12:05:53 2026
HibernationDevice: RESUME=UUID=f2799cf1-38b5-43b9-80b1-9f330e95c354
InstallationDate: Installed on 2024-12-22 (622 days ago)
InstallationMedia: Kubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827)
MachineType: CyberPowerPC GamingPC
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.8.0-139-generic
root=UUID=d7e17bac-b56c-4498-b5e0-e249bd682b7d ro quiet
cryptdevice=UUID=c8b193ba-0124-495f-a549-091eb877b76a:cryptroot
root=/dev/mapper/cryptroot splash
resume=UUID=f2799cf1-38b5-43b9-80b1-9f330e95c354 "acpi_osi=Windows 2022"
nvidia_drm.fbdev=1 vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.8.0-139-generic N/A
linux-backports-modules-6.8.0-139-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 01/29/2026
dmi.bios.release: 30.2
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 3002
dmi.board.asset.tag: Default string
dmi.board.name: Z890 MAX GAMING WIFI7
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 3
dmi.chassis.vendor: Default string
dmi.chassis.version: Default string
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvr3002:bd01/29/2026:br30.2:svnCyberPowerPC:pnGamingPC:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnZ890MAXGAMINGWIFI7:rvrRev1.xx:cvnDefaultstring:ct3:cvrDefaultstring:skuCPPC-SYSTEM-US:
dmi.product.family: C Series
dmi.product.name: GamingPC
dmi.product.sku: CPPC-SYSTEM-US
dmi.product.version: System Version
dmi.sys.vendor: CyberPowerPC
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166577
Title:
Bluetooth NULL pointer dereference in btmtk_usb_hci_wmt_sync on MT7925
(6.8.0-139, regression from 138)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166577/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
