Public bug reported:
Bluetooth: Huawei FreeBuds no longer connect - BR/EDR signalling-MTU
check discards vendor frames
Since a recent noble kernel update Huawei FreeBuds 3 pair successfully but never
finish connecting. The ACL link comes up, authentication and encryption succeed,
and the earbuds tear the link down about 160 ms later with reason 0x13 (Remote
User Terminated). The cycle repeats every 3-4 seconds and never converges - 36
consecutive attempts over four minutes in my testing.
ROOT CAUSE
The earbuds send battery telemetry as a 68-byte L2CAP Echo Request on the
signalling channel:
<-- L2CAP Echo Request ident=129 len=64
payload: "AT+HUAWEIBATTERY=6,2,100,3,0,4,100,5,0,6,35,7,0\r"
--> L2CAP Command Reject reason=1 (Signalling MTU exceeded) max_mtu=48
The noble tree carries the commit "Bluetooth: L2CAP: reject BR/EDR signaling
packets over MTUsig" (Michael Bommarito, author date 2026-09-03), which adds
L2CAP_SIG_MTU (48) to include/net/bluetooth/l2cap.h and makes
l2cap_sig_channel()
discard any signalling packet above it:
if (skb->len > L2CAP_SIG_MTU) {
u8 ident = skb->data[1];
BT_DBG("signaling packet exceeds MTU: %u > %u",
skb->len, L2CAP_SIG_MTU);
l2cap_sig_send_mtu_rej(conn, ident);
goto drop;
}
The Echo Request therefore never reaches the L2CAP_ECHO_REQ handler and no Echo
Response is sent. The device waits for it, stalls, and disconnects.
Vanilla 6.8, 6.12 and 6.15 do not contain this check, so this is specific to
trees carrying that commit.
HCI level, showing that the crypto side is fine and the remote simply
hangs up:
Connect Complete status=0x00
Link Key Request
Auth Complete status=0x00
Encryption Change status=0x00 enabled=1
...
Disconnect Complete status=0x00 reason=0x13 (Remote User Terminated)
IMPACT
Bluetooth audio hardware that worked on earlier noble kernels stops working
after
a routine kernel update, with no error visible to the user - the device simply
never connects. The failure mode gives no hint that a kernel change is
responsible.
VERIFICATION
Rebuilding only bluetooth.ko with L2CAP_SIG_MTU raised from 48 to 672 restores
normal operation: the earbuds connect on the first attempt, A2DP comes up, and
the link has been stable since. No other change.
SUGGESTED HANDLING
The device is out of spec - Bluetooth Core 5.4, Vol 3, Part A section 4 puts
MTUsig at 48 octets - so the commit is correct as written. But discarding the
whole packet regresses working hardware. Continuing to process commands that fit
within MTUsig, or answering Echo Requests regardless of size, would keep
interoperability. At minimum this deserves a release-note mention, since
affected
users have no way to connect the symptom to the kernel.
ENVIRONMENT
Ubuntu 24.04, kernel 6.8.0-147-generic (also reproduced on 6.8.0-146-generic)
BlueZ 5.72, PipeWire 1.0.5
Intel AX201, firmware ibt-17-16-1 155-35.23
Huawei FreeBuds 3
Control: JBL TUNE770NC connects and plays normally on the same host
ANALYSIS, PATCH AND BUILD INSTRUCTIONS
https://github.com/prostopasta/freebuds-l2cap-sig-mtu
Note for anyone reproducing: btmon from bluez 5.72 in noble aborts immediately
with "*** buffer overflow detected ***". Traces were captured with
"tcpdump -i bluetooth-monitor" instead; a decoder is in the repository above.
That btmon crash is filed separately as
https://github.com/bluez/bluez/issues/2704
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-147-generic 6.8.0-147.147
ProcVersionSignature: Ubuntu 6.8.0-147.147-generic 6.8.12
Uname: Linux 6.8.0-147-generic x86_64
NonfreeKernelModules: zfs
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: ps 4453 F.... pipewire
ps 4457 F.... wireplumber
/dev/snd/seq: ps 4453 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: XFCE
Date: Sat Oct 24 01:08:00 2026
InstallationDate: Installed on 2024-08-04 (811 days ago)
InstallationMedia: Asmi Noble 24.04 - Release amd64
MachineType: HP HP EliteBook 840 G6
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/@/boot/vmlinuz-6.8.0-147-generic
root=UUID=e1aaee12-a8b4-4127-8773-42c0ca481f40 ro rootflags=subvol=@ quiet
splash resume=UUID=cd253e95-ddd0-469b-b0bf-8ea5196ae8de vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.8.0-147-generic N/A
linux-backports-modules-6.8.0-147-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 06/13/2026
dmi.bios.release: 36.0
dmi.bios.vendor: HP
dmi.bios.version: R70 Ver. 01.36.00
dmi.board.name: 8549
dmi.board.vendor: HP
dmi.board.version: KBC Version 52.71.00
dmi.chassis.type: 10
dmi.chassis.vendor: HP
dmi.ec.firmware.release: 82.113
dmi.modalias:
dmi:bvnHP:bvrR70Ver.01.36.00:bd06/13/2026:br36.0:efr82.113:svnHP:pnHPEliteBook840G6:pvrSBKPFV3:rvnHP:rn8549:rvrKBCVersion52.71.00:cvnHP:ct10:cvr:sku7HT84EC#ABA:
dmi.product.family: 103C_5336AN HP EliteBook
dmi.product.name: HP EliteBook 840 G6
dmi.product.sku: 7HT84EC#ABA
dmi.product.version: SBKPFV3
dmi.sys.vendor: HP
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble third-party-packages
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172088
Title:
Bluetooth: Huawei FreeBuds no longer connect - BR/EDR signalling-MTU
check discards vendor frames
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172088/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
