Confirming this on a MediaTek MT7922 (USB 0e8d:e616) in a Framework Laptop 13
(AMD Ryzen 7040 Series). Same trace and same fault address (0x219) as the
original report.
System:
Ubuntu 24.04.4 LTS
Broken: 6.8.0-139-generic (crashes on 2/2 boots, cold boot and reboot)
Working: 6.8.0-138-generic (Bluetooth fully functional, incl. A2DP/HFP audio)
linux-firmware: 20240318.git3b128b60.0ubuntu3.1
BIOS: Framework 03.20 (2026-06-23)
Bluetooth: MediaTek MT7922, USB 0e8d:e616
Wi-Fi (unaffected): MT7922 via mt7921e, ASIC revision 79220010
Symptom: bluetoothd starts normally but there is no controller. hci0 exists and
is stuck DOWN with a null address, so the desktop Bluetooth toggle does nothing:
hci0: Type: Primary Bus: USB
BD Address: 00:00:00:00:00:00 ACL MTU: 0:0 SCO MTU: 0:0
DOWN INIT RUNNING
$ bluetoothctl show
No default controller available
Nothing is rfkill-blocked (hci0: soft=0 hard=0) and the firmware blob is present
(/lib/firmware/mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin.zst). The driver oopses
while downloading firmware, the hci0 worker dies, and nothing retries; the
adapter cannot be recovered without a reboot (reloading btusb just re-triggers
the oops).
Kernel oops (register dump trimmed):
Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20250523103438
BUG: kernel NULL pointer dereference, address: 0000000000000219
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 2 PID: 170 Comm: kworker/u33:0 Not tainted 6.8.0-139-generic #139-Ubuntu
Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS
03.20 06/23/2026
Workqueue: hci0 hci_power_on [bluetooth]
RIP: 0010:__pm_runtime_resume+0x1b/0x80
Call Trace:
<TASK>
usb_autopm_get_interface+0x1d/0x60
btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk]
btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk]
btusb_mtk_setup+0x453/0x610 [btusb]
hci_dev_setup_sync+0x6c/0x430 [bluetooth]
? __pm_runtime_idle+0x4c/0xd0
hci_dev_init_sync+0x3e/0x1c0 [bluetooth]
hci_dev_open_sync+0xb1/0x350 [bluetooth]
? srso_alias_return_thunk+0x5/0xfbef5
hci_dev_do_open+0x28/0x70 [bluetooth]
hci_power_on+0x50/0x210 [bluetooth]
? srso_alias_return_thunk+0x5/0xfbef5
? __try_to_del_timer_sync+0x5f/0xa0
process_one_work+0x181/0x3a0
worker_thread+0x18b/0x330
? __pfx_worker_thread+0x10/0x10
kthread+0xef/0x120
? __pfx_kthread+0x10/0x10
ret_from_fork+0x44/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASK>
---[ end trace 0000000000000000 ]---
Regression window: this machine ran 6.8.0-138 until an `apt upgrade` on
2026-09-04 22:04 that took it to 6.8.0-139 and also moved linux-firmware from
20240318.git3b128b60-0ubuntu2.29 to .0ubuntu3.1. Bluetooth worked throughout the
preceding boot (journal shows an A2DP transport active on hci0 on 2026-09-02 and
2026-09-03) and has oopsed on every boot since. The firmware change appears not
to be involved -- other reporters here saw the same crash with unchanged
firmware, and firmware downgrades have not helped in reports elsewhere.
Possible cause, for whoever picks this up: 6.8.0-139.139 pulled "Noble update:
upstream stable patchset 2026-07-09 (LP: #2160250)", which includes v6.6.142 and
with it the btmtk refactor series:
Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c
Bluetooth: btmtk: rename btmediatek_data
Bluetooth: btmtk: add the function to get the fw name
Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset
The identical crash was reported upstream against 6.6.142/6.6.143 (absent in
6.6.140) by Thorsten Leemhuis and is tracked as
https://bugzilla.kernel.org/show_bug.cgi?id=221696 -- that report notes it does
not reproduce on mainline. That points at the stable backport of the wmt_sync
move landing without everything it depends on, leaving the USB interface pointer
unset when btmtk_usb_hci_wmt_sync() calls usb_autopm_get_interface() during the
WMT firmware handshake. If that is right, the same defect reached Noble's 6.8
tree through the 6.6.142 backport, and a fix would need the missing dependency
rather than a firmware change.
Workaround confirmed here: boot 6.8.0-138-generic.
** Bug watch added: Linux Kernel Bug Tracker #221696
https://bugzilla.kernel.org/show_bug.cgi?id=221696
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166544
Title:
Kernel NULL pointer dereference in btmtk_usb_hci_wmt_sync on
6.8.0-139-generic (MT7921 / 13d3:3567)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166544/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
