[Bug 2137291] Re: mt7925e: Kernel panic NULL pointer dereference in mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop

Patch 3

** Patch added: "0003-wifi-mt76-mt7925-fix-missing-mutex-protection-in-run.patch"
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+attachment/5936862/+files/0003-wifi-mt76-mt7925-fix-missing-mutex-protection-in-run.patch

--
You received this bug notification because you are subscribed to linux
in Ubuntu.
Matching subscriptions: Bgg, Bmail, Nb
https://bugs.launchpad.net/bugs/2137291

Title:
mt7925e: Kernel panic NULL pointer dereference in
mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop

Status in linux package in Ubuntu:
New

Bug description:
(Refiling this bug with more data from `ubuntu-bug linux` and a
correct title)

System experiences kernel panics causing complete lockups when the mt7925e WiFi driver
attempts to reset after association failures.

Hardware: Framework Desktop (AMD Ryzen AI Max 300 Series)
BIOS: 03.04 (11/19/2025)
WiFi Card: MediaTek MT7925 (RZ717) Wi-Fi 7 at c0:00.0
Firmware: Build Time: 20250721232943

Root Cause:
NULL pointer dereference in mt76_connac_mcu_uni_add_dev() function at offset 0xba
during WiFi MAC reset workflow.

Crash Pattern:
1. WiFi association attempts fail/timeout with AP
2. Driver logs "Message timeout" errors (sequences 6-10)
3. mt7925_mac_reset_work initiated
4. During interface re-initialization via ieee80211_iterate_interfaces
5. mt76_connac_mcu_uni_add_dev attempts to dereference NULL pointer
6. Kernel panic - system completely locks up

Frequency: Multiple crashes per day, making system unusable

This appears to be a known issue affecting multiple users on Ubuntu 25.10
kernel 6.17.0-8 with this hardware.

ProblemType: Bug
DistroRelease: Ubuntu 25.10
Package: linux-image-6.17.0-8-generic 6.17.0-8.8
ProcVersionSignature: Ubuntu 6.17.0-8.8-generic 6.17.2
Uname: Linux 6.17.0-8-generic x86_64
ApportVersion: 2.33.1-0ubuntu3
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: gdm-greeter 6080 F.... wireplumber
/dev/snd/controlC0: gdm-greeter 6080 F.... wireplumber
/dev/snd/seq: gdm-greeter 6066 F.... pipewire
CasperMD5CheckResult: pass
Date: Tue Dec 30 17:36:29 2025
InstallationDate: Installed on 2025-11-30 (30 days ago)
InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007)
MachineType: Framework Desktop (AMD Ryzen AI Max 300 Series)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-ghostty
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.17.0-8-generic root=UUID=7c001a2e-fa2b-447b-98ee-6322215addb9 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M vt.handoff=7
RelatedPackageVersions:
firmware-sof N/A
linux-firmware 20250901.git993ff19b-0ubuntu1.4
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/19/2025
dmi.bios.release: 3.4
dmi.bios.vendor: INSYDE Corp.
dmi.bios.version: 03.04
dmi.board.asset.tag: *
dmi.board.name: FRANMFCP06
dmi.board.vendor: Framework
dmi.board.version: A6
dmi.chassis.asset.tag: FRAMDACPA65382007P
dmi.chassis.type: 35
dmi.chassis.vendor: Framework
dmi.chassis.version: A6
dmi.modalias: dmi:bvnINSYDECorp.:bvr03.04:bd11/19/2025:br3.4:svnFramework:pnDesktop(AMDRyzenAIMax300Series):pvrA6:rvnFramework:rnFRANMFCP06:rvrA6:cvnFramework:ct35:cvrA6:skuFRAMDACP06:
dmi.product.family: Desktop
dmi.product.name: Desktop (AMD Ryzen AI Max 300 Series)
dmi.product.sku: FRAMDACP06
dmi.product.version: A6
dmi.sys.vendor: Framework

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+subscriptions