Public bug reported:
SUMMARY
On kernel 6.8.0-139-generic, the Bluetooth controller on a MediaTek
MT7922 Wi-Fi/Bluetooth combo adapter fails to initialize. The kernel
throws a NULL pointer dereference during firmware setup, hci0 never
comes up, and `bluetoothctl` reports "No default controller available"
even though rfkill shows the device as present and unblocked.
Booting the previous point release, 6.8.0-138-generic, with no other
changes, fixes the issue completely — Bluetooth initializes normally
and the controller powers on.
HARDWARE
- Adapter: MediaTek MT7922 802.11ax PCIe Wi-Fi + Bluetooth combo
(lspci: "04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax
PCI Express Wireless Network Adapter", driver mt7921e)
- Bluetooth HCI: hci0, driver btusb/btmtk
- Laptop: Framework 15
AFFECTED / WORKING KERNELS
- Broken: 6.8.0-139-generic (6.8.0-139.139)
- Working: 6.8.0-138-generic (6.8.0-138.138)
STEPS TO REPRODUCE
1. Boot 6.8.0-139-generic
2. Run `rfkill list` — hci0 shows present, not soft/hard blocked
3. Run `systemctl status bluetooth` — service is active/running
4. Run `bluetoothctl show` — reports "No default controller available"
5. Attempt to enable Bluetooth from GNOME Settings — toggle does not
turn on / has no effect
6. Check `sudo dmesg | grep -A30 btmtk_setup_firmware_79xx` — shows a
kernel oops with a NULL pointer dereference (see trace below)
EXPECTED BEHAVIOR
Bluetooth controller initializes normally and can be enabled from
Settings, as it does on 6.8.0-138-generic.
ACTUAL BEHAVIOR
Kernel oops during hci_power_on -> btmtk firmware setup, controller
never registers with BlueZ.
KERNEL OOPS (6.8.0-139-generic)
[ 4.747120] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time:
20250523103438
[ 4.747142] Workqueue: hci0 hci_power_on [bluetooth]
[ 4.747201] btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
[ 4.747204] ? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk]
[ 4.747207] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk]
[ 4.747212] btusb_mtk_setup+0x453/0x610 [btusb]
[ 4.747218] hci_dev_setup_sync+0x6c/0x430 [bluetooth]
[ 4.747241] ? __pm_runtime_idle+0x4c/0xd0
[ 4.747244] hci_dev_init_sync+0x3e/0x1c0 [bluetooth]
[ 4.747278] hci_dev_open_sync+0xb1/0x350 [bluetooth]
[ 4.747318] hci_dev_do_open+0x28/0x70 [bluetooth]
[ 4.747352] hci_power_on+0x50/0x210 [bluetooth]
[ 4.747398] process_one_work+0x181/0x3a0
[ 4.747404] worker_thread+0x18b/0x330
[ 4.747412] kthread+0xef/0x120
[ 4.747420] ret_from_fork+0x44/0x70
[ 4.747428] ret_from_fork_asm+0x1b/0x30
[ 4.747435] </TASK>
[ 4.747574] CR2: 0000000000000219
[ 4.747578] ---[ end trace 0000000000000000 ]---
[ 5.002337] mt7921e 0000:04:00.0: HW/SW Version: 0x8a108a10, Build Time:
20250523103150a
[ 5.109748] mt7921e 0000:04:00.0: WM Firmware Version: ____000000, Build
Time: 20250523103234
Note CR2 = 0x219, a small offset from NULL — consistent with a NULL
struct pointer being dereferenced with a field offset inside
btmtk_setup_firmware_79xx / btmtk_usb_hci_wmt_sync.
Also note the Bluetooth and Wi-Fi halves of the chip both print
firmware version info at boot; the Wi-Fi half (mt7921e) succeeds while
the Bluetooth half (btmtk) crashes. This may point to a race or shared
resource issue between the two drivers on this combo chip.
ADDITIONAL SYMPTOM
While investigating, running `sudo modprobe -r btusb` on the affected
kernel (6.8.0-139-generic) hung indefinitely in an uninterruptible
state (did not respond to Ctrl+C), suggesting the driver may leave a
lock or work item in a bad state after the initial oops.
WORKAROUND
Booting 6.8.0-138-generic instead of 6.8.0-139-generic resolves the
issue with no other changes. Reinstalling linux-firmware and rebooting
on 6.8.0-139-generic did NOT resolve it, suggesting this is a kernel/
driver regression rather than a firmware blob issue.
ADDITIONAL INFO
$ lspci -k | grep -A3 -i network
04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless
Network Adapter
Subsystem: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network
Adapter
Kernel driver in use: mt7921e
Kernel modules: mt7921e
$ rfkill list
0: hci0: Bluetooth
Soft blocked: no
Hard blocked: no
1: phy0: Wireless LAN
Soft blocked: no
Hard blocked: no
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-138-generic 6.8.0-138.138
ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12
Uname: Linux 6.8.0-138-generic x86_64
ApportVersion: 2.28.1-0ubuntu3.8
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC2: plaba 4379 F.... wireplumber
/dev/snd/controlC0: plaba 4379 F.... wireplumber
/dev/snd/controlC1: plaba 4379 F.... wireplumber
/dev/snd/seq: plaba 4375 F.... pipewire
CRDA: N/A
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Fri Sep 11 22:37:14 2026
InstallationDate: Installed on 2021-12-11 (1736 days ago)
InstallationMedia: Ubuntu 20.04.3 LTS "Focal Fossa" - Release amd64 (20210819)
MachineType: Framework Laptop 16 (AMD Ryzen 7040 Series)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic
root=UUID=0cd2207b-af42-4735-8148-fa96decb31f3 ro security=selinux quiet splash
intel_iommu=off
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.8.0-138-generic N/A
linux-backports-modules-6.8.0-138-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: Upgraded to noble on 2026-02-21 (202 days ago)
dmi.bios.date: 12/22/2025
dmi.bios.release: 4.3
dmi.bios.vendor: INSYDE Corp.
dmi.bios.version: 04.03
dmi.board.asset.tag: *
dmi.board.name: FRANMZCP07
dmi.board.vendor: Framework
dmi.board.version: A7
dmi.chassis.asset.tag: FRAGACCPA744840005
dmi.chassis.type: 10
dmi.chassis.vendor: Framework
dmi.chassis.version: A7
dmi.modalias:
dmi:bvnINSYDECorp.:bvr04.03:bd12/22/2025:br4.3:svnFramework:pnLaptop16(AMDRyzen7040Series):pvrA7:rvnFramework:rnFRANMZCP07:rvrA7:cvnFramework:ct10:cvrA7:skuFRAGACCP07:
dmi.product.family: 16in Laptop
dmi.product.name: Laptop 16 (AMD Ryzen 7040 Series)
dmi.product.sku: FRAGACCP07
dmi.product.version: A7
dmi.sys.vendor: Framework
modified.conffile..etc.apport.crashdb.conf: [modified]
mtime.conffile..etc.apport.crashdb.conf: 2023-04-23T16:21:23.712186
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble third-party-packages
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167148
Title:
Bluetooth (MediaTek MT7922) fails to initialize with NULL pointer
dereference in btmtk_setup_firmware_79xx on 6.8.0-139-generic; works
on 6.8.0-138-generic
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167148/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
