Hi, thought I'd chime in, also affected. Knocked out the BT chip of my Framework 16. Attaching more information to the ticket in case it helps.
Similar disclosure as OP, the comment below comes from Claude Code/Opus 4.8. --- Independent reproduction on MediaTek MT7922 (Framework "RZ616"), confirming this is not MT7925-specific. HARDWARE - Framework Laptop 16 (AMD Ryzen 7040 Series) - Bluetooth: MT7922 USB 0e8d:e616 (btusb + btmtk). Wi-Fi side is mt7921e (PCIe) and is unaffected. - Ubuntu noble SAME REGRESSION BOUNDARY AS REPORTED (from my journal, 10 boots): - 6.8.0-138.138 -- Bluetooth initializes normally. Aug 21 - Sep 2, 7 boots, no oops, valid BD address. - 6.8.0-139.139 -- crashes on every boot. Sep 5, 3 boots. Controller left DOWN INIT with address 00:00:00:00:00:00. BT firmware is identical on both kernels (Build Time: 20250523103438); only the kernel differs. OOPS ON 6.8.0-139 (matches the reported __pm_runtime_resume(NULL) mechanism): BUG: kernel NULL pointer dereference, address: 0000000000000219 Oops: 0000 [#1] PREEMPT SMP NOPTI Workqueue: hci0 hci_power_on [bluetooth] RIP: 0010:__pm_runtime_resume+0x1b/0x80 Call Trace: btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk] btusb_mtk_setup+0x453/0x610 [btusb] hci_dev_setup_sync+0x6c/0x430 [bluetooth] hci_dev_init_sync+0x3e/0x1c0 [bluetooth] hci_dev_open_sync+0xb1/0x350 [bluetooth] hci_dev_do_open+0x28/0x70 [bluetooth] hci_power_on+0x50/0x210 [bluetooth] WORKAROUND CONFIRMED: booting 6.8.0-138 restores internal Bluetooth. (A USB CSR dongle also works, since it doesn't go through btusb_mtk_setup().) This confirms the report's "MT7921/MT7922/MT7925 all affected" statement on real MT7922 hardware and a second platform (Framework Laptop 16, vs. the original MSI desktop). Full 6.8.0-139 dmesg attached. ** Attachment added: "lp2166509-mt7922-dmesg-6.8.0-139.sanitized.txt" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166509/+attachment/5997817/+files/lp2166509-mt7922-dmesg-6.8.0-139.sanitized.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166509 Title: NULL pointer dereference in btmtk_usb_hci_wmt_sync kills MT7925 Bluetooth in 6.8.0-139 (regression from 6.8.0-138) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166509/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
