Public bug reported: Bluetooth is completely non-functional on 6.8.0-139-generic. The kernel hits a NULL pointer dereference in btmtk_usb_hci_wmt_sync() during MediaTek Bluetooth firmware setup, on every single boot. The adapter never finishes initialisation, so no devices can be discovered or paired.
6.8.0-138-generic on the exact same machine works correctly — Bluetooth initialises and device discovery finds nearby devices as expected. This gives a clean regression window between two consecutive Ubuntu kernel builds. Impact: Bluetooth is unusable. The GUI scanner reports zero devices even though many are in range. No workaround exists other than booting the previous kernel. Hardware: Model: Lenovo Legion 5 Pro 16ARH7H (LENOVO 82RG / LNVNB161216) BIOS: JUCN68WW, 12/05/2024 Bluetooth: MediaTek MT7921 (btusb / btmtk), HW/SW Version: 0x008a008a, firmware Build Time: 20250523103438 Wi-Fi: mt7921e (same MediaTek combo chip) GPU: AMD Radeon 680M (Rembrandt) + NVIDIA RTX 3070 Mobile Software: Ubuntu 24.04 LTS (noble) Affected: 6.8.0-139-generic — Bluetooth broken, oops on every boot Working: 6.8.0-138-generic — Bluetooth fully functional Steps to reproduce: 1) Boot 6.8.0-139-generic. 2) Run journalctl -b -k | grep -A45 'NULL pointer' — the oops is present. 3) Open the Bluetooth settings GUI and start device discovery. Expected: Nearby Bluetooth devices are listed. Actual: The list stays empty; the adapter never completed setup. Booting 6.8.0-138-generic instead: no oops, discovery works. Reproducibility: 100%. Checked across five consecutive boots (journalctl -b -N for N = 0..4), the oops is present in every one of them on -139. Kernel oops: BUG: kernel NULL pointer dereference, address: 0000000000000219 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 171 Comm: kworker/u33:0 Tainted: P OE 6.8.0-139-generic #139-Ubuntu Hardware name: LENOVO 82RG/LNVNB161216, BIOS JUCN68WW 12/05/2024 Workqueue: hci0 hci_power_on [bluetooth] RIP: 0010:__pm_runtime_resume+0x1b/0x80 RSP: 0018:ffffd126406d7b30 EFLAGS: 00010246 RAX: ffff8be3823e54d0 RBX: 0000000000000050 RCX: 0000000000000000 RDX: 0000000000000035 RSI: 0000000000000000 RDI: 0000000000000050 RBP: ffffd126406d7b50 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000004 R13: 0000000000000035 R14: 000000000000003a R15: ffffd126406d7be8 FS: 0000000000000000(0000) GS:ffff8bea9e380000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000219 CR3: 0000000109376000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: <TASK> usb_autopm_get_interface+0x1d/0x60 btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] ? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk] btmtk_setup_firmware_79xx+0x1ca/0x360 [btmtk] btusb_mtk_setup+0x453/0x610 [btusb] hci_dev_setup_sync+0x6f/0x430 [bluetooth] ? __pm_runtime_idle+0x4c/0xd0 hci_dev_init_sync+0x3e/0x1c0 [bluetooth] hci_dev_open_sync+0xb1/0x350 [bluetooth] ? srso_alias_return_thunk+0x5/0xfbef5 hci_dev_do_open+0x28/0x70 [bluetooth] hci_power_on+0x50/0x210 [bluetooth] ? srso_alias_return_thunk+0x5/0xfbef5 ? __try_to_del_timer_sync+0x5f/0xa0 process_one_work+0x184/0x3a0 worker_thread+0x18b/0x330 ? __pfx_worker_thread+0x10/0x10 kthread+0xf2/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> pstore: backend (efi_pstore) writing error (-5) follows immediately, so the oops is not captured to pstore on this machine. Note: the kernel is tainted (P ... OE) by the out-of-tree NVIDIA DKMS module, but the failing path is entirely in btmtk / btusb / bluetooth and does not involve it. Upstream analysis: This matches a known upstream regression in the MediaTek Bluetooth driver, reported against stable 6.6.142/6.6.143 (not present in 6.6.140): Kernel bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=221696 btmtk_usb_hci_wmt_sync() calls usb_autopm_get_interface() on an interface that is not yet in a valid state, so __pm_runtime_resume() dereferences NULL. The fix chain is in mainline and has been queued by the stable maintainer for 6.6.y: 5c5e8c52e3caf Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c 67dba2c28fe0af Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices 099799fa9b76c5 Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown f0c83a23fcbb42 Bluetooth: btmtk: Fix btmtk.c undefined reference build error Request: Please backport this chain to the noble 6.8 kernel. The partial backport currently in 6.8.0-139 appears to have introduced the regression without the accompanying fixes. Workaround: Boot 6.8.0-138-generic ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139 ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 NonfreeKernelModules: nvidia_modeset nvidia ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: kolobchanin 2231 F.... wireplumber /dev/snd/controlC0: kolobchanin 2231 F.... wireplumber /dev/snd/controlC1: kolobchanin 2231 F.... wireplumber /dev/snd/seq: kolobchanin 2229 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: KDE Date: Tue Sep 22 15:01:49 2026 InstallationDate: Installed on 2023-11-09 (1048 days ago) InstallationMedia: Kubuntu 22.04.3 LTS "Jammy Jellyfish" - Release amd64 (20230807.1) MachineType: LENOVO 82RG ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=86e7c39c-42e3-470a-95c6-1703714ddbb0 ro quiet splash pcie_aspm=force acpi_backlight=native vt.handoff=7 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 SourcePackage: linux UpgradeStatus: Upgraded to noble on 2024-10-12 (710 days ago) dmi.bios.date: 12/05/2024 dmi.bios.release: 1.68 dmi.bios.vendor: LENOVO dmi.bios.version: JUCN68WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: NO DPK dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Legion 5 Pro 16ARH7H dmi.ec.firmware.release: 1.66 dmi.modalias: dmi:bvnLENOVO:bvrJUCN68WW:bd12/05/2024:br1.68:efr1.66:svnLENOVO:pn82RG:pvrLegion5Pro16ARH7H:rvnLENOVO:rnLNVNB161216:rvrNODPK:cvnLENOVO:ct10:cvrLegion5Pro16ARH7H:skuLENOVO_MT_82RG_BU_idea_FM_Legion5Pro16ARH7H: dmi.product.family: Legion 5 Pro 16ARH7H dmi.product.name: 82RG dmi.product.sku: LENOVO_MT_82RG_BU_idea_FM_Legion 5 Pro 16ARH7H dmi.product.version: Legion 5 Pro 16ARH7H dmi.sys.vendor: LENOVO ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug bluetooth kernel-bug noble regression-update ** Attachment added: "attachments.txt" https://bugs.launchpad.net/bugs/2167943/+attachment/6001702/+files/attachments.txt ** Tags added: bluetooth kernel-bug regression-update -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167943 Title: Bluetooth broken on 6.8.0-139: NULL pointer dereference in btmtk_usb_hci_wmt_sync (regression from 6.8.0-138) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167943/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
