Thanks for updating the SRU text. It currently combines separate failures and attributes the original NULL dereference to the wrong commits. I checked the upstream mapping against the September 20 status and the current Ubuntu 7.0 package record.
1. *Original bug: reset-time NULL dereference.* The crash reported here is in the reset link-replay path, where a missing link configuration reaches mt76_connac_mcu_uni_add_dev(). The direct upstream fix is bd8b2ec83818 <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bd8b2ec83818>, “wifi: mt76: mt7925: fix crash in reset link replay” (v7.2). Vadik reports this crash remains in Ubuntu 7.0.0-31.31~24.04.1. This is the fix relevant to the original report and needs an explicit backport/SRU for affected Ubuntu kernels, including Resolute linux and Noble linux-hwe-7.0 if those are the intended targets. 2. *Separate issue: ROC deadlock.* dd08ca3f092f <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd08ca3f092f> fixes the deadlock in mt7925_roc_abort_sync(); it does not fix the reset NULL dereference. Vadik confirms Ubuntu 7.0 has this since 7.0.0-28.28, so 7.0 should not be listed as needing this deadlock fix. 3. *9e4d518a4707 <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9e4d518a4707>* passes the MLO link into mac_link_sta_remove(). It is a separate v7.1 change, not the fix for the reported crash. It has also been bisected as a cause of a separate MLO connectivity-stall regression, so I would not describe it as a remedy for this bug or bundle it without evaluating that regression. 4. *Other adjacent fixes:* 341639421954 <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=341639421954> fixes list corruption in mt76_wcid_cleanup(); 0fff5b5e2786 <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fff5b5e2786> drops WCID reinitialization after publication. These are separate v7.1 fixes, corresponding to other issues in my mt76 PR #1029, not the same NULL dereference. So the SRU description should either be narrowed to the ROC deadlock and target only kernels that lack dd08ca3f092f, or, for this bug as originally reported, describe the reset NULL dereference and cite bd8b2ec83818. The PR was closed “Handled upstream,” but that does not mean the two commits currently listed resolve both failures. Thanks, Zac On Thu, 24 Sep 2026 17:46:33 -0000, Viktor Pashaiev < [email protected]> wrote: Moved the SRU justification into the main bug description following Canonical guidelines, and added noble/resolute targets. The two upstream fix commits apply cleanly and resolve the MT7925 ROC deadlock and MAC reset NULL pointer dereference. ** Description changed: - (Refiling this bug with more data from `ubuntu-bug linux` and a correct - title) + [ Impact ] + + Systems using the MediaTek MT7925 (RZ717) Wi-Fi 7 chipset suffer from + intermittent kernel panics and hard system lockups during AP roaming, + multi-link operations (MLO), or connection resets. + + The failure manifests as an AB-BA deadlock between cfg80211_wiphy_work + and mt7925_roc_work, where cancel_work_sync() is invoked while holding + the mt76 mutex, followed by a NULL pointer dereference in + mt76_connac_mcu_uni_add_dev() during interface re-initialization. + + Once triggered, the kernel wedges, wpa_supplicant hangs in + uninterruptible sleep (D state), and the system completely freezes, + requiring a hard power cycle. + + [ Fix ] + + Backport the two upstream fixes merged into mainline Linux: + - dd08ca3f092f ("wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync") + - 9e4d518a4707 ("wifi: mt76: mt7925: pass mlink to mac_link_sta_remove()") + + These commits fix the mutex locking order during remain-on-channel (ROC) + abort and ensure mlink is properly passed during station removal, + preventing the NULL pointer dereference and deadlock during WiFi reset. + + [ Test Plan ] + + 1. Setup: A system with the MediaTek MT7925 (RZ717) Wi-Fi 7 adapter (e.g. Framework Desktop AMD Ryzen AI Max 300 / Framework 16) running Ubuntu. + 2. Connect to a multi-band Wi-Fi network (2.4 / 5 / 6 GHz) and trigger rapid roaming or forced AP re-association. + 3. Check system behavior: + - Without fix: Association failures trigger mt7925_mac_reset_work, leading to NULL dereference in mt76_connac_mcu_uni_add_dev() and immediate hard freeze. + - With fix: WiFi disconnects, resets, and roaming complete cleanly. No kernel panics, zero D-state tasks, and zero lockdep splats appear in dmesg. + + [ Where problems could occur ] + + The changes are strictly isolated to + drivers/net/wireless/mediatek/mt76/mt7925/. + + They ensure mutex locking order is preserved during ROC abort and pass + valid station link structures. Regression risk is very low and + restricted exclusively to MT7925 wireless devices. + + [ Other Info ] + + - Upstream commits: Mainline Linux commits dd08ca3f092f and 9e4d518a4707. + - Target releases: Ubuntu 24.04 LTS (Noble linux-hwe-6.8), Ubuntu 25.10 (Questing linux 6.17), Ubuntu 26.04 (Resolute linux 7.0). + - User verification: Fix was verified and confirmed working by users across 6.17 and 7.0 kernel lines. + + --- [ Original Report ] + (Refiling this bug with more data from `ubuntu-bug linux` and a correct title) System experiences kernel panics causing complete lockups when the mt7925e WiFi driver attempts to reset after association failures. Hardware: Framework Desktop (AMD Ryzen AI Max 300 Series) BIOS: 03.04 (11/19/2025) WiFi Card: MediaTek MT7925 (RZ717) Wi-Fi 7 at c0:00.0 Firmware: Build Time: 20250721232943 Root Cause: NULL pointer dereference in mt76_connac_mcu_uni_add_dev() function at offset 0xba during WiFi MAC reset workflow. Crash Pattern: 1. WiFi association attempts fail/timeout with AP 2. Driver logs "Message timeout" errors (sequences 6-10) 3. mt7925_mac_reset_work initiated 4. During interface re-initialization via ieee80211_iterate_interfaces 5. mt76_connac_mcu_uni_add_dev attempts to dereference NULL pointer 6. Kernel panic - system completely locks up Frequency: Multiple crashes per day, making system unusable This appears to be a known issue affecting multiple users on Ubuntu 25.10 kernel 6.17.0-8 with this hardware. ProblemType: Bug DistroRelease: Ubuntu 25.10 Package: linux-image-6.17.0-8-generic 6.17.0-8.8 ProcVersionSignature: Ubuntu 6.17.0-8.8-generic 6.17.2 Uname: Linux 6.17.0-8-generic x86_64 ApportVersion: 2.33.1-0ubuntu3 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: gdm-greeter 6080 F.... wireplumber /dev/snd/controlC0: gdm-greeter 6080 F.... wireplumber /dev/snd/seq: gdm-greeter 6066 F.... pipewire CasperMD5CheckResult: pass Date: Tue Dec 30 17:36:29 2025 InstallationDate: Installed on 2025-11-30 (30 days ago) InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007) MachineType: Framework Desktop (AMD Ryzen AI Max 300 Series) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.17.0-8-generic root=UUID=7c001a2e-fa2b-447b-98ee-6322215addb9 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M vt.handoff=7 RelatedPackageVersions: firmware-sof N/A linux-firmware 20250901.git993ff19b-0ubuntu1.4 SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 11/19/2025 dmi.bios.release: 3.4 dmi.bios.vendor: INSYDE Corp. dmi.bios.version: 03.04 dmi.board.asset.tag: * dmi.board.name: FRANMFCP06 dmi.board.vendor: Framework dmi.board.version: A6 dmi.chassis.asset.tag: FRAMDACPA65382007P dmi.chassis.type: 35 dmi.chassis.vendor: Framework dmi.chassis.version: A6 dmi.modalias: dmi:bvnINSYDECorp.:bvr03.04:bd11/19/2025:br3.4:svnFramework:pnDesktop(AMDRyzenAIMax300Series):pvrA6:rvnFramework:rnFRANMFCP06:rvrA6:cvnFramework:ct35:cvrA6:skuFRAMDACP06: dmi.product.family: Desktop dmi.product.name: Desktop (AMD Ryzen AI Max 300 Series) dmi.product.sku: FRAMDACP06 dmi.product.version: A6 dmi.sys.vendor: Framework ** Tags added: mt7925 noble resolute wifi -- You received this bug notification because you are subscribed to the bug report. https://bugs.launchpad.net/bugs/2137291 Title: mt7925e: Kernel panic NULL pointer dereference in mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+subscriptions -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2137291 Title: mt7925e: Kernel panic NULL pointer dereference in mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
