[Bug 2166487] Re: Kernel oops (NULL pointer deref) in btmtk_usb_hci_wmt_sync on MediaTek MT7921 BT during hci_power_on, 6.8.0-139-generic

Confirmed on Ubuntu 24.04.4 LTS, Lenovo 82MS, with MediaTek MT7921 Wi- Fi/Bluetooth (Bluetooth USB ID 0489:e0cd). After upgrading to 6.8.0-139, every boot logs a NULL pointer dereference at address 0x219 in __pm_runtime_resume, called through usb_autopm_get_interface and btmtk_usb_hci_wmt_sync during hci_power_on. Closing the lid subsequently leaves the laptop unresponsive with a black screen, requiring a forced power-off. Booting the installed 6.8.0-138-generic kernel restores normal lid suspend and wake behavior. No other settings or packages were changed between these tests. This seems to be the same bug as reported for linux-hwe-6.8 package: https://bugs.launchpad.net/ubuntu/+source/linux-hwe-6.8/+bug/2165873 The non-HWE linux should probably receive the same fix too. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2166487 Title: Kernel oops (NULL pointer deref) in btmtk_usb_hci_wmt_sync on MediaTek MT7921 BT during hci_power_on, 6.8.0-139-generic Status in linux package in Ubuntu: Confirmed Bug description: Bluetooth fails to initialize on 6.8.0-139-generic (Ubuntu 24.04.4 LTS) on a system with a MediaTek MT7921 combo Wi-Fi/BT card. Bluetooth worked fine on 6.8.0-138-generic and earlier kernels; this appears after upgrading to 6.8.0-139-generic. hci0 remains DOWN with BD Address 00:00:00:00:00:00 and "No default controller available" is reported by bluetoothctl. The bluetooth service itself starts fine, but the controller never comes up. dmesg shows a kernel oops triggered during hci_power_on, in the MediaTek BT firmware setup path: CR2: 0000000000000219 RIP: __pm_runtime_resume+0x1b/0x80 Call Trace: usb_autopm_get_interface+0x1d/0x60 btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] btmtk_setup_firmware_79xx+0x1ca/0x360 [btmtk] btusb_mtk_setup+0x453/0x610 [btusb] hci_dev_setup_sync+0x6f/0x430 [bluetooth] hci_dev_init_sync+0x3e/0x1c0 [bluetooth] hci_dev_open_sync+0xb1/0x350 [bluetooth] hci_dev_do_open+0x28/0x70 [bluetooth] hci_power_on+0x50/0x210 [bluetooth] This looks like a NULL pointer dereference on the USB interface pointer (data->intf) passed to usb_autopm_get_interface(), similar in nature to the class of MediaTek btmtk/btusb autopm issues fixed upstream (e.g. commit "Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices", and LP: #2092473 for linux-oem-6.11). Hardware: 01:00.0 Network controller: MEDIATEK Corp. MT7921 802.11ax PCI Express Wireless Network Adapter DeviceName: Tequini MediaTek Wi-Fi 6 MT7921 + BT5.2 Kernel driver in use: mt7921e Steps to reproduce: 1. Boot 6.8.0-139-generic 2. Bluetooth service starts automatically (bluetoothd active) 3. hci0 never comes up; kernel oops appears in dmesg during hci_power_on 4. bluetoothctl show reports "No default controller available" Workaround: booting 6.8.0-138-generic (previous kernel) restores working Bluetooth on the same hardware. uname -a: Linux ict-hp 6.8.0-139-generic #139-Ubuntu SMP PREEMPT_DYNAMIC Sat Aug 1 03:52:05 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux lsb_release -a: Distributor ID: Ubuntu Description: Ubuntu 24.04.4 LTS Release: 24.04 Codename: noble Full dmesg oops trace attached separately. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166487/+subscriptions