*** This bug is a security vulnerability ***
Private security bug reported:
# Kernel bug: __queue_work WARNING storm, display freeze and Bluetooth
mouse disconnect
**Observed:** 2026-10-20 and 2026-10-23
**Distribution:** Ubuntu 26.04.1 LTS
**Kernel:** 7.0.0-38-generic
**Platform:** ASUS Vivobook S16 S5650AA, BIOS S5650AA.322 (2026-10-07)
**CPU:** Intel Core Ultra 7 356H (Panther Lake)
**GPU:** Intel integrated Xe (PCI 8086:b0a0), driver xe 1.1.0, GuC 70.58.0, DMC
2.33
**WiFi:** Realtek RTL8852BE PCIe (10ec:b852), driver rtw89_8852be
**Bluetooth:** Realtek RTL8852BU USB (0bda:b85b), driver btusb + btrtl,
firmware 0x42d34e04
**Display:** Samsung ATNA60HS01 OLED 2560x1600 eDP
**LibreOffice:** 26.2.6.3
## Summary
Three hard display/input freezes on this platform:
1. 2026-10-20 17:08:11 — `__queue_work` WARNING, black screen, forced power-off.
2. 2026-10-20 17:59:58 — black screen, no warning logged, forced power-off.
3. 2026-10-23 13:35:12 — four `__queue_work` WARNINGs within 7 seconds (one
inside the Realtek WiFi IRQ thread), black screen and Bluetooth mouse link drop
almost simultaneously, forced power-off.
All three end with an abruptly truncated journal and no clean shutdown.
No vmcore was produced and kdump was armed. There was no OOM, thermal
event, ECC error or PCIe AER error. The two 2026-10-20 events occurred
within about five minutes of resuming/unlocking; the 2026-10-23 event
occurred about seven minutes after resuming from s2idle.
## Event 1 — 2026-10-20 17:08
- 16:23:07 — lid closed, system enters s2idle.
- 17:03:19 — system resumes.
- 17:08:11.215 — `WARNING: kernel/workqueue.c:2351 at
__queue_work.part.0+0x190/0x390`, CPU#6, `swapper/6/0`, call trace through
`delayed_work_timer_fn` from `cpuidle_enter_state`.
- 17:08:14 — last journal entry; forced power-off.
- 17:09:54 — next boot.
- 17:10:12 — journald reports the previous journal was corrupted / not cleanly
closed.
- No `xe`/DRM error, no `DSB timeout`, no `flip_done timed out`, no vmcore.
## Event 2 — 2026-10-20 17:59
- 17:59:58 — last journal entry; black screen; forced power-off.
- 18:01:47 — next boot.
- 18:02:08 — journald reports the previous journal was corrupted / not cleanly
closed.
- No kernel WARNING was persisted for this event; no `xe`/DRM error, no vmcore.
## Event 3 — 2026-10-23 13:35
- 13:09:07 — lid closed, system enters s2idle.
- 13:28:14 — system resumes; Bluetooth controller re-initializes; WiFi
reconnects.
- 13:29:06 — Bluetooth mouse reconnects.
- 13:35:06 — a 30.6 MB `.pptx` file is created (freshly downloaded/copied).
- 13:35:08 — the file is accessed; LibreOffice starts loading it.
- 13:35:12.067 — WARNING #1: `__queue_work`, CPU#9, `swapper/9/0`
(delayed_work_timer_fn from timer softirq / cpuidle).
- 13:35:13.091 — WARNING #2: `__queue_work`, CPU#9, `irq/204-rtw89_p`. Call
trace contains `rtw89_pci_interrupt_threadfn`.
- 13:35:18.723 — WARNING #3: `__queue_work`, CPU#3, `swapper/3/0`.
- 13:35:19.235 — WARNING #4: `__queue_work`, CPU#10, `swapper/10/0`.
- **At about 13:35:12 — almost simultaneously with the first warnings — the
internal display goes black and the Bluetooth mouse link drops.** There is no
`Bluetooth: hci0` disconnect/error message in the journal; the relevant
work/IRQ path appears to be stuck.
- 13:35:21–13:35:55 — an unrelated user-space daemon continues writing logs
every 3 seconds, indicating that some CPUs/processes are still alive.
- 13:36:25 — a user-space process still writes a file, confirming partial
system liveness.
- ~13:37 — the machine is force-powered off.
- 13:37:32 — next boot.
- 13:38:00 — the Bluetooth mouse reconnects and works normally after the reboot.
## Kernel warnings
All four warnings have the same signature:
```
WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390
RIP: 0010:__queue_work.part.0+0x190/0x390
Call Trace:
<IRQ>
__queue_work+0x39/0xc0
delayed_work_timer_fn+0x19/0x30
call_timer_fn+0x30/0x170
__run_timers+0x1af/0x2c0
run_timer_softirq+0xeb/0x100
handle_softirqs+0xe1/0x360
</IRQ>
```
WARNING #2 additionally contains:
```
CPU: 9 UID: 0 PID: 1708 Comm: irq/204-rtw89_p Kdump: loaded
Tainted: G W 7.0.0-38-generic #38-Ubuntu PREEMPT(lazy)
...
rtw89_pci_interrupt_threadfn+0x138/0x330 [rtw89_pci]
```
The other three occur from `cpuidle_enter_state` / `swapper` (idle
CPUs). The kernel is tainted only by the WARN (`Tainted: [W]=WARN`).
## Symptoms
- The internal eDP display stops updating (black screen).
- The Bluetooth mouse link drops at almost the same moment as the black screen.
No `Bluetooth: hci0` disconnect/error is logged, consistent with the Bluetooth
work/IRQ path being stuck.
- Some unrelated user-space processes continue running, so this is a partial
kernel hang rather than an immediate full power loss.
- kdump is armed (`kexec_crash_loaded=1`) but no vmcore was produced after the
forced power-offs.
## Suspected cause
A kernel workqueue bug in the drain/destroy reject path: when a delayed
work timer fires while its workqueue is draining or being destroyed,
`__queue_work()` rejects the work and the PENDING bit may be left set.
Upstream has a fix titled:
> workqueue: Release PENDING in __queue_work() drain/destroy reject path
The Realtek RTL8852 combo (rtw89 WiFi + btusb/btrtl Bluetooth) is the
common hardware path around the warning and the Bluetooth drop. The
display freeze may be another delayed work stranded by the same
workqueue state, or an independent Xe display issue.
## Reproduction
1. Boot the affected platform and let the system suspend/resume once.
2. Ensure the Realtek WiFi and Bluetooth controller are active.
3. Open a large (~30 MB) `.pptx` file in LibreOffice Impress.
4. Observe the `__queue_work` warnings, black screen and Bluetooth mouse drop
within seconds.
## Ruled out
- No OOM: 30 GB RAM, swap unused.
- No thermal event: no thermal throttling or critical-temperature message; idle
temperature around 35 °C.
- No memory errors: EDAC correctable/uncorrectable counters both zero.
- No PCIe errors: no AER / bus error messages.
- No classic kernel panic: kdump armed, no vmcore.
- Battery and power readings normal.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-38-generic 7.0.0-38.38
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: bruce 5106 F.... wireplumber
/dev/snd/seq: bruce 5087 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Fri Oct 23 14:03:43 2026
InstallationDate: Installed on 2026-10-17 (6 days ago)
InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64
(20260826)
MachineType: ASUS Vivobook S16 S5650AA
ProcEnviron:
LANG=zh_CN.UTF-8
PATH=(custom, user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 xedrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 07/10/2026
dmi.bios.release: 3.22
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: S5650AA.322
dmi.board.asset.tag: Default string
dmi.board.name: S5650AA
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: 1.0
dmi.chassis.asset.tag: NULL
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK COMPUTER INC.
dmi.chassis.version: 1.0
dmi.ec.firmware.release: 3.12
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrS5650AA.322:bd07/10/2026:br3.22:efr3.12:svnASUS:pnVivobookS16S5650AA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnS5650AA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaVivobookS16:
dmi.product.family: Vivobook S16
dmi.product.name: Vivobook S16 S5650AA
dmi.product.version: 1.0
dmi.sys.vendor: ASUS
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172014
Title:
Kernel bug: __queue_work WARNING storm, display freeze and Bluetooth
mouse disconnect
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172014/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
