I can confirm the exact same failure mode (Variant A) on a different system. Same workqueue, same mt76_dma_add_buf page fault, same invalid DMA write after chip reset failed.
System Ubuntu 24.04.5 LTS ASUS TUF GAMING X670E-PLUS WIFI BIOS 1413 (2023-04-26) AMD Ryzen 9 7950X Wi-Fi: MEDIATEK Corp. MT7922 802.11ax PCIe Wireless Network Adapter [14c3:0616] Subsystem: Foxconn International, Inc. [105b:e0cd] Driver: mt7921e Firmware: HW/SW 0x8a108a10 build 20250523103150a WM: ____000000 build 20250523103234 Kernel at crash: 6.8.0-139-generic #139-Ubuntu SMP PREEMPT_DYNAMIC Sat Aug 1 03:52:05 UTC 2026 (Ubuntu 6.8.0-139.139-generic 6.8.12) Module state at crash: mt7921e.disable_aspm=N Wi-Fi power save: on efi_pstore captured the full Oops (~792989s uptime at crash). Crash sequence Code block mt7921e 0000:0b:00.0: driver own failed mt7921e 0000:0b:00.0: Timeout for driver own mt7921e 0000:0b:00.0: chip reset failed wlp11s0: Driver requested disconnection from AP ec:da:59:81:e3:61 BUG: unable to handle page fault for address: ffffcae3007d0ff0 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 1002a9067 PMD 101046067 PTE 0 Oops: 0002 [#2] PREEMPT SMP NOPTI CPU: 30 PID: 47595 Comm: kworker/u64:2 Tainted: G D OE 6.8.0-139-generic #139-Ubuntu Hardware name: ASUS System Product Name/TUF GAMING X670E-PLUS WIFI, BIOS 1413 04/26/2023 Workqueue: mt76 mt7921_mac_reset_work [mt7921_common] RIP: 0010:mt76_dma_add_buf.isra.0+0x8b/0x220 [mt76] Code: 01 00 00 4c 89 75 b8 41 0f b7 73 2a 44 8d 40 ff 31 c9 4c 89 65 b0 eb 3d 8b 45 d4 8d 78 fe 44 89 e8 80 cc 40 39 cf 44 0f 44 e8 <45> 89 0f 83 c1 02 48 83 c3 20 41 89 77 08 89 d6 45 89 57 0c 45 89 RSP: 0018:ffffcae3018abb50 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffffcae3018abbe0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89a40ce61468 RBP: ffffcae3018abbc8 R08: 0000000000000000 R09: 00000000fe673c10 R10: 0000000000000000 R11: ffff89a40ce61468 R12: ffff89a42f6b0000 R13: 0000000040400000 R14: 0000000000400000 R15: ffffcae3007d0ff0 FS: 0000000000000000(0000) GS:ffff89baf8900000(0000) knlGS:0000000000000000 CR2: ffffcae3007d0ff0 CR3: 000000074e03c000 CR4: 0000000000f50ef0 Call Trace: <TASK> ? srso_alias_return_thunk+0x5/0xfbef5 ? iommu_dma_map_page+0xc0/0x2c0 mt76_dma_tx_queue_skb_raw+0x10f/0x1c0 [mt76] mt7921_mcu_send_message+0x56/0x70 [mt7921e] mt76_mcu_skb_send_and_get_msg+0x74/0x130 [mt76] mt76_mcu_send_and_get_msg+0x85/0xb0 [mt76] mt76_connac_mcu_uni_add_dev+0x12d/0x1f0 [mt76_connac_lib] mt7921_vif_connect_iter+0x41/0xe0 [mt7921_common] __iterate_interfaces+0xa0/0x110 [mac80211] ieee80211_iterate_interfaces+0x3e/0x60 [mac80211] mt7921_mac_reset_work+0x114/0x1a0 [mt7921_common] process_one_work+0x181/0x3a0 worker_thread+0x18b/0x330 kthread+0xef/0x120 ret_from_fork+0x44/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> CR2: ffffcae3007d0ff0 ---[ end trace 0000000000000000 ]--- This is exactly the "reset failed, but the driver keeps using the DMA rings" problem described in the bug. With panic_on_oops=0, the machine freezes instead of rebooting; a hard power-off is required. Kernel availability / request As of 2026-10-12, the available Ubuntu 24.04 kernels do not contain the CVE-2026-90379 fix: current linux-generic is 6.8.0-146.146 HWE candidate is linux-generic-hwe-24.04 7.0.0-38.38~24.04.4 Ubuntu bug #2170366 reports the same crash on 7.0.0-38-generic, even with pcie_aspm=off The upstream fix is: 6.18.52: 670b3dc4e3713542a9f002d38fb9d1740b9e342b 7.2.6: f544bcba4721e1074e9bc6666f0ef4f8b96ddba8 7.3-rc1: 915672c5ae32deeb72f4572856d123f314791136 Could the Ubuntu kernel team please backport the CVE-2026-90379 changes (the mt76 AER handler / DMA index validation / bus_hung handling) to the noble 6.8 and HWE 7.0 kernels? I can attach the full reassembled efi_pstore log (dmesg.txt / debug.txt) for the trace above. ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90379 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2168654 Title: mt7921e: kernel Oops in mt7921_mac_reset_work after "chip reset failed" (page fault in mt76_dma_add_buf / GPF in __mt76_tx_complete_skb) freezes the system To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168654/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
