[Bug 2137291] Re: mt7925e: Kernel panic NULL pointer dereference in mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop

The deadlock half of this report — the AB-BA deadlock between cfg80211_wiphy_work and mt7925_roc_work that hard-freezes the machine — is now in mainline, authored by Sean Wang (no attribution to Zac's stellar work, but internet knows :-) ) and merged via the mt76 tree: - dd08ca3f092f4185ece69ce2a835c23198b1628a — "wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync" https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd08ca3f092f4185ece69ce2a835c23198b1628a - 9e4d518a4707175e1154876b760d4f2b39967e9d — "wifi: mt76: mt7925: pass mlink to mac_link_sta_remove()" https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9e4d518a4707175e1154876b760d4f2b39967e9d I can confirm on a Framework Laptop 16 (Ryzen AI 7 350, MT7925) running 24.04 LTS with the linux-hwe-6.17 kernel (6.17.0-35-generic) that this deadlock reproduces reliably on the stock kernel — captured kernel stack traces match this report exactly (cfg80211_wiphy_work → mt7925_mac_link_sta_remove → cancel_work_sync holding the mt76 mutex, while mt7925_roc_work blocks on the same mutex; NetworkManager/wpa_supplicant then wedge in D state and reboot hangs). It is resolved by the patched DKMS build. The stock 6.17.0-35 changelog does not yet include these commits. Now that the upstream-acceptance gate is met for the deadlock fix: is there a plan/timeline to SRU these two commits into the linux-hwe-6.17 (24.04 LTS) and linux 6.17 (25.10) kernels? Separately, it's not clear what is happening with the NULL-pointer- dereference fix (mt76_connac_mcu_uni_add_dev) and when it might land upstream. Zac, any chance for reviving https://lkml.org/lkml/2026/1/29/484 thread now that at least some changes landed in mainline? -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2137291 Title: mt7925e: Kernel panic NULL pointer dereference in mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop Status in linux package in Ubuntu: Confirmed Bug description: (Refiling this bug with more data from `ubuntu-bug linux` and a correct title) System experiences kernel panics causing complete lockups when the mt7925e WiFi driver attempts to reset after association failures. Hardware: Framework Desktop (AMD Ryzen AI Max 300 Series) BIOS: 03.04 (11/19/2025) WiFi Card: MediaTek MT7925 (RZ717) Wi-Fi 7 at c0:00.0 Firmware: Build Time: 20250721232943 Root Cause: NULL pointer dereference in mt76_connac_mcu_uni_add_dev() function at offset 0xba during WiFi MAC reset workflow. Crash Pattern: 1. WiFi association attempts fail/timeout with AP 2. Driver logs "Message timeout" errors (sequences 6-10) 3. mt7925_mac_reset_work initiated 4. During interface re-initialization via ieee80211_iterate_interfaces 5. mt76_connac_mcu_uni_add_dev attempts to dereference NULL pointer 6. Kernel panic - system completely locks up Frequency: Multiple crashes per day, making system unusable This appears to be a known issue affecting multiple users on Ubuntu 25.10 kernel 6.17.0-8 with this hardware. ProblemType: Bug DistroRelease: Ubuntu 25.10 Package: linux-image-6.17.0-8-generic 6.17.0-8.8 ProcVersionSignature: Ubuntu 6.17.0-8.8-generic 6.17.2 Uname: Linux 6.17.0-8-generic x86_64 ApportVersion: 2.33.1-0ubuntu3 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: gdm-greeter 6080 F.... wireplumber /dev/snd/controlC0: gdm-greeter 6080 F.... wireplumber /dev/snd/seq: gdm-greeter 6066 F.... pipewire CasperMD5CheckResult: pass Date: Tue Dec 30 17:36:29 2025 InstallationDate: Installed on 2025-11-30 (30 days ago) InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007) MachineType: Framework Desktop (AMD Ryzen AI Max 300 Series) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.17.0-8-generic root=UUID=7c001a2e-fa2b-447b-98ee-6322215addb9 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M vt.handoff=7 RelatedPackageVersions: firmware-sof N/A linux-firmware 20250901.git993ff19b-0ubuntu1.4 SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 11/19/2025 dmi.bios.release: 3.4 dmi.bios.vendor: INSYDE Corp. dmi.bios.version: 03.04 dmi.board.asset.tag: * dmi.board.name: FRANMFCP06 dmi.board.vendor: Framework dmi.board.version: A6 dmi.chassis.asset.tag: FRAMDACPA65382007P dmi.chassis.type: 35 dmi.chassis.vendor: Framework dmi.chassis.version: A6 dmi.modalias: dmi:bvnINSYDECorp.:bvr03.04:bd11/19/2025:br3.4:svnFramework:pnDesktop(AMDRyzenAIMax300Series):pvrA6:rvnFramework:rnFRANMFCP06:rvrA6:cvnFramework:ct35:cvrA6:skuFRAMDACP06: dmi.product.family: Desktop dmi.product.name: Desktop (AMD Ryzen AI Max 300 Series) dmi.product.sku: FRAMDACP06 dmi.product.version: A6 dmi.sys.vendor: Framework To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+subscriptions