[Bug 2168310] Re: Kernel panic in __run_timers / __queue_work on HP Pavilion 15-cs3xxx, kernels 7.0.0-30 and 7.0.0-31

Hi, Thanks for submitting a bug report. When did you first notice this issue? Have you tried any earlier versions of the 7.0.0 kernel? It would really help to narrow down when this bug was introduced. If it is caused by the kernel ideally we would find the exact release that introduced it (e.g. -25 works but -26 doesn't). -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2168310 Title: Kernel panic in __run_timers / __queue_work on HP Pavilion 15-cs3xxx, kernels 7.0.0-30 and 7.0.0-31 Status in linux package in Ubuntu: New Bug description: System repeatedly hangs or fully panics on Ubuntu 26.04, HP Pavilion Laptop 15-cs3xxx (BIOS F.21). Reproduced on both linux-image-7.0.0-30-generic and linux-image-7.0.0-31-generic, so it is not specific to one kernel build. Symptom: - Most occurrences: system freezes completely and must be hard-rebooted. - One occurrence produced a full kernel panic instead of a silent hang: "Kernel panic - not syncing: Fatal exception in interrupt", 67 seconds after boot, i.e. during early session/network startup rather than after prolonged use. Crash signature (consistent across all occurrences, captured via pstore): - RIP: __run_timers+0x1d8-0x1e0 or __queue_work.part.0+0x190/0x390 (kernel/workqueue.c:2351) - RAX/R12 = dead000000000122 — indicates a timer/work item's memory was already freed (poisoned list pointer) while still queued, i.e. a use-after-free in some driver's delayed_work/timer teardown. - Observed with the process context being, on different occasions: swapper/0 (idle), gnome-shell, and thunderbird-bin — so it is not tied to one specific userspace application; it appears to be triggered by network/Bluetooth related driver activity (iwlwifi, mac80211, bluetooth, btusb, btintel, btrtl, btmtk are loaded in every crash). Disabling network before opening Thunderbird reliably avoided the crash in my testing; enabling networking reliably reproduced it within seconds to a couple of minutes. Steps that reliably reproduce it: 1. Boot normally with Wi-Fi/Bluetooth enabled. 2. Open Thunderbird (snap or otherwise) and let mail sync over the network, OR simply use the desktop normally with networking active. 3. Within roughly 10 seconds to a few minutes, the workqueue WARNING/BUG fires and the system hangs or panics. Ruled out during troubleshooting: - Not specific to Thunderbird: also captured with gnome-shell and swapper/0 as the offending context. - Not caused by the NVIDIA driver: reproduced with the nvidia module fully unloaded/removed (dkms package removed) and prime-select set to intel-only. - Not a Secure Boot signing issue (unrelated "Key was rejected" errors were resolved separately and are not connected to this crash). ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-31-generic 7.0.0-31.31 ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14 Uname: Linux 7.0.0-31-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: javier2 2260 F.... wireplumber /dev/snd/seq: javier2 2228 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Wed Sep 23 22:27:46 2026 InstallationDate: Installed on 2025-11-02 (325 days ago) InstallationMedia: Ubuntu 25.04 "Plucky Puffin" - Release amd64 (20250415.3) MachineType: HP HP Pavilion Laptop 15-cs3xxx ProcEnviron: LANG=es_ES.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-31-generic root=UUID=0b5509e7-7678-4c83-922c-29cff4bee36e ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-06-13 (102 days ago) dmi.bios.date: 12/08/2023 dmi.bios.release: 15.21 dmi.bios.vendor: Insyde dmi.bios.version: F.21 dmi.board.asset.tag: Type2 - Board Asset Tag dmi.board.name: 86E2 dmi.board.vendor: HP dmi.board.version: 95.36 dmi.chassis.asset.tag: Chassis Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: HP dmi.chassis.version: Chassis Version dmi.ec.firmware.release: 95.36 dmi.modalias: dmi:bvnInsyde:bvrF.21:bd12/08/2023:br15.21:efr95.36:svnHP:pnHPPavilionLaptop15-cs3xxx:pvrType1ProductConfigId:rvnHP:rn86E2:rvr95.36:cvnHP:ct10:cvrChassisVersion:sku7VM48EA#ABE:pfa103C_5335KVHPPavilion: dmi.product.family: 103C_5335KV HP Pavilion dmi.product.name: HP Pavilion Laptop 15-cs3xxx dmi.product.sku: 7VM48EA#ABE dmi.product.version: Type1ProductConfigId dmi.sys.vendor: HP To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168310/+subscriptions