Public bug reported:
================================================================================
1) RELEASE OF UBUNTU
================================================================================
$ lsb_release -rd
Description: Ubuntu 24.04.5 LTS
Release: 24.04
$ cat /proc/version_signature
Ubuntu 6.8.0-139.139-generic 6.8.12
================================================================================
2) PACKAGE VERSION
================================================================================
$ apt-cache policy linux-image-generic
linux-image-generic:
Installed: 6.8.0-139.139
Candidate: 6.8.0-139.139
Version table:
*** 6.8.0-139.139 500
500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
Affected (bad): linux-image-6.8.0-139-generic 6.8.0-139.139
Last known good: linux-image-6.8.0-138-generic 6.8.0-138.138
Also installed: linux-firmware-mediatek 20240318.git3b128b60-0ubuntu3.1
bluez 5.72-0ubuntu5.5
================================================================================
3) WHAT I EXPECTED TO HAPPEN
================================================================================
After booting, the MediaTek MT7922 Bluetooth controller should complete firmware
setup and be registered with BlueZ, so that `bluetoothctl show` reports a
controller and paired devices can connect -- as it did on 6.8.0-138-generic.
================================================================================
4) WHAT HAPPENED INSTEAD
================================================================================
The kernel takes a NULL pointer dereference inside the btmtk module during
controller setup. The hci0 hci_power_on workqueue dies mid-setup, leaving the
adapter permanently half-initialised, and no controller is ever exposed to
BlueZ:
$ bluetoothctl show
No default controller available
$ hciconfig -a
hci0: Type: Primary Bus: USB
BD Address: 00:00:00:00:00:00 ACL MTU: 0:0 SCO MTU: 0:0
DOWN INIT RUNNING
The all-zero BD address and the stuck "DOWN INIT" state are the visible symptom
of the setup worker having been killed by the oops. Bluetooth is therefore
completely unusable.
This is not recoverable at runtime -- reloading btusb/btmtk, restarting
bluetooth.service, `rfkill unblock all`, and power-cycling the USB device all
re-trigger the same oops. Only booting an older kernel restores Bluetooth.
Wi-Fi on the same combo chip (mt7921e, PCI 0000:02:00.0) is unaffected and works
normally, so this is specific to the Bluetooth side of the device.
================================================================================
REGRESSION DETAILS
================================================================================
Last known good: 6.8.0-138-generic (6.8.0-138.138)
First known bad: 6.8.0-139-generic (6.8.0-139.139)
Confirmed against the persistent journal across the last 11 boots. Every boot on
6.8.0-134/-136/-138 completed Bluetooth setup with no oops; both boots on
6.8.0-139 oopsed and never completed setup:
boot kernel date btmtk oops BT setup completed
---- ------------------ ---------- ---------- ------------------
0 6.8.0-139-generic 2026-09-14 yes no
-1 6.8.0-139-generic 2026-09-11 yes no
-2 6.8.0-138-generic 2026-09-05 no yes
-3 6.8.0-138-generic 2026-09-01 no yes
-4 6.8.0-136-generic 2026-07-29 no yes
-5 6.8.0-136-generic 2026-07-27 no yes
-6 6.8.0-136-generic 2026-07-24 no yes
-7 6.8.0-136-generic 2026-07-22 no yes
-8 6.8.0-134-generic 2026-07-18 no yes
-9 6.8.0-134-generic 2026-07-16 no yes
-10 6.8.0-134-generic 2026-07-11 no yes
For contrast, the same hardware on the immediately preceding kernel
(6.8.0-138-generic, boot -2, 2026-09-05):
kernel: Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20240219111427
kernel: Bluetooth: hci0: Device setup in 3728433 usecs
kernel: Bluetooth: hci0: AOSP extensions version v1.00
kernel: Bluetooth: hci0: AOSP quality report is supported
kernel: Bluetooth: MGMT ver 1.22
On 6.8.0-139-generic the log stops dead after the identical "HW/SW Version" line
-- the oops happens at exactly the next step, and "Device setup in ..." never
appears.
Nothing else relevant changed -- Bluetooth worked before this kernel upgrade and
broke immediately after it.
Both Bluetooth modules changed between the two kernels, and these are genuine
source changes rather than rebuilds (srcversion differs):
btmtk.ko 138: ABB465557685891189D1481
139: 8FA9557BBF30706BB129AFF
btusb.ko 138: 336B8A418C3CF8CAEF8D88A
139: 55C655636660E6A2B00E2E2
Firmware was ruled out as a cause: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin.zst
is
present and passes a zstd integrity check, and the running kernel has
CONFIG_FW_LOADER_COMPRESS_ZSTD=y. The crash happens before any firmware payload
is transferred.
================================================================================
HARDWARE
================================================================================
System: ASUSTeK COMPUTER INC. Vivobook_ASUSLaptop M1502IA_M1502IA/M1502IA
BIOS: M1502IA.312 06/05/2023
CPU: AMD (amd_pmc, kvm_amd)
Bluetooth: MediaTek MT7922, USB ID 13d3:3563 (IMC Networks Wireless_Device)
Wi-Fi: mt7921e, ASIC revision 79610010
================================================================================
STEPS TO REPRODUCE
================================================================================
1. Boot linux-image-6.8.0-139-generic on a machine with an MT7922 btusb adapter.
2. Observe the oops in `dmesg` during boot (btusb probe / hci_power_on).
3. Run `bluetoothctl show` -> "No default controller available".
Reproduces on every boot, 100% of the time.
================================================================================
KERNEL OOPS
================================================================================
Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20240219111427
BUG: kernel NULL pointer dereference, address: 0000000000000219
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 145 Comm: kworker/u27:0 Not tainted 6.8.0-139-generic #139-Ubuntu
Hardware name: ASUSTeK COMPUTER INC. Vivobook_ASUSLaptop
M1502IA_M1502IA/M1502IA, BIOS M1502IA.312 06/05/2023
Workqueue: hci0 hci_power_on [bluetooth]
RIP: 0010:__pm_runtime_resume+0x1b/0x80
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5
41 56 41 55 41 54 41 89 f4 83 e6 01 53 48 89 fb 75 09 <f6> 87 c9 01 00 00 04 74
4a 41 f6 c4 04 74 07 f0 ff 83 c0 01 00 00
RSP: 0018:ffffcfae40633b30 EFLAGS: 00010246
RAX: ffff8e1fc70d54d0 RBX: 0000000000000050 RCX: 0000000000000000
RDX: 0000000000000015 RSI: 0000000000000000 RDI: 0000000000000050
RBP: ffffcfae40633b50 R08: 0183400090000000 R09: 000000ffffffff00
R10: ffffffff00018340 R11: 0000000200000000 R12: 0000000000000004
R13: 0000000000000035 R14: 000000000000003a R15: ffffcfae40633be8
FS: 0000000000000000(0000) GS:ffff8e24b7480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000219 CR3: 000000012f066000 CR4: 0000000000350ef0
Call Trace:
<TASK>
usb_autopm_get_interface+0x1d/0x60
btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk]
btmtk_setup_firmware_79xx+0x1ca/0x360 [btmtk]
btusb_mtk_setup+0x453/0x610 [btusb]
hci_dev_setup_sync+0x6f/0x430 [bluetooth]
? __pm_runtime_idle+0x4c/0xd0
hci_dev_init_sync+0x3e/0x1c0 [bluetooth]
hci_dev_open_sync+0xb1/0x350 [bluetooth]
hci_dev_do_open+0x28/0x70 [bluetooth]
hci_power_on+0x50/0x210 [bluetooth]
process_one_work+0x184/0x3a0
worker_thread+0x18b/0x330
kthread+0xf2/0x120
ret_from_fork+0x47/0x70
ret_from_fork_asm+0x1b/0x30
</TASK>
CR2: 0000000000000219
---[ end trace 0000000000000000 ]---
================================================================================
ANALYSIS
================================================================================
The faulting instruction at __pm_runtime_resume+0x1b decodes as:
testb $0x4, 0x1c9(%rdi)
with RDI = 0x50 and CR2 = 0x219 (= 0x50 + 0x1c9), confirming the struct device
pointer passed in is 0x50 rather than a valid address.
The caller is usb_autopm_get_interface(), which passes &intf->dev. Since
offsetof(struct usb_interface, dev) is 0x50, &intf->dev == 0x50 means intf
itself
is NULL.
btmtk_usb_hci_wmt_sync() obtains that pointer from its private data:
struct btmtk_data *data = hci_get_priv(hdev);
...
usb_autopm_get_interface(data->intf);
So btmtk_data->intf is still NULL by the time btusb_mtk_setup() ->
btmtk_setup_firmware_79xx() -> btmtk_usb_hci_wmt_sync() runs. It looks like the
btmtk changes in 6.8.0-139 introduced (or moved) the usb_autopm_get_interface()
call in the WMT path without the corresponding initialisation of
btmtk_data->intf on this code path -- i.e. a partial or misordered backport of
the upstream btmtk USB refactor. Adding the missing initialisation, or a NULL
guard before the autopm call, should be sufficient.
Note the oops happens in the hci0 hci_power_on workqueue, so the failure is
otherwise silent -- btmtk never gets far enough to log a firmware error, which
is
why this initially looks like a firmware problem.
================================================================================
WORKAROUND
================================================================================
Boot the previous kernel, 6.8.0-138-generic, from GRUB's "Advanced options for
Ubuntu" menu. Bluetooth works normally there.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-139-generic 6.8.0-139.139
ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12
Uname: Linux 6.8.0-139-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC2: mstorchak 3033 F.... wireplumber
/dev/snd/controlC1: mstorchak 3033 F.... wireplumber
/dev/snd/controlC0: mstorchak 3033 F.... wireplumber
/dev/snd/seq: mstorchak 3030 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Mon Sep 14 09:58:18 2026
HibernationDevice: RESUME=UUID=d749b922-af3c-4fea-b382-e2ea60bd3749
MachineType: ASUSTeK COMPUTER INC. Vivobook_ASUSLaptop M1502IA_M1502IA
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.8.0-139-generic
root=/dev/mapper/crypt-root ro quiet splash vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.8.0-139-generic N/A
linux-backports-modules-6.8.0-139-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: Upgraded to noble on 2025-05-15 (487 days ago)
WifiSyslog:
dmi.bios.date: 06/05/2023
dmi.bios.release: 5.16
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: M1502IA.312
dmi.board.asset.tag: ATN12345678901234567
dmi.board.name: M1502IA
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: 1.0
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK COMPUTER INC.
dmi.chassis.version: 1.0
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvrM1502IA.312:bd06/05/2023:br5.16:svnASUSTeKCOMPUTERINC.:pnVivobook_ASUSLaptopM1502IA_M1502IA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnM1502IA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:
dmi.product.family: Vivobook
dmi.product.name: Vivobook_ASUSLaptop M1502IA_M1502IA
dmi.product.version: 1.0
dmi.sys.vendor: ASUSTeK COMPUTER INC.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 bluetooth btmtk kernel-oops mt7922 noble regression-update
** Attachment added: "mt7922-btmtk-regression-6.8.0-139.txt"
https://bugs.launchpad.net/bugs/2167213/+attachment/6000061/+files/mt7922-btmtk-regression-6.8.0-139.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167213
Title:
btmtk: NULL pointer dereference in btmtk_usb_hci_wmt_sync() breaks
MT7922 Bluetooth (regression in 6.8.0-139-generic)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167213/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
