Moved the SRU justification into the main bug description following Canonical
guidelines, and added noble/resolute targets.
The two upstream fix commits apply cleanly and resolve the MT7925 ROC deadlock
and MAC reset NULL pointer dereference.
** Description changed:
- (Refiling this bug with more data from `ubuntu-bug linux` and a correct
- title)
+ [ Impact ]
+
+ Systems using the MediaTek MT7925 (RZ717) Wi-Fi 7 chipset suffer from
+ intermittent kernel panics and hard system lockups during AP roaming,
+ multi-link operations (MLO), or connection resets.
+
+ The failure manifests as an AB-BA deadlock between cfg80211_wiphy_work
+ and mt7925_roc_work, where cancel_work_sync() is invoked while holding
+ the mt76 mutex, followed by a NULL pointer dereference in
+ mt76_connac_mcu_uni_add_dev() during interface re-initialization.
+
+ Once triggered, the kernel wedges, wpa_supplicant hangs in
+ uninterruptible sleep (D state), and the system completely freezes,
+ requiring a hard power cycle.
+
+ [ Fix ]
+
+ Backport the two upstream fixes merged into mainline Linux:
+ - dd08ca3f092f ("wifi: mt76: mt7925: fix potential deadlock in
mt7925_roc_abort_sync")
+ - 9e4d518a4707 ("wifi: mt76: mt7925: pass mlink to mac_link_sta_remove()")
+
+ These commits fix the mutex locking order during remain-on-channel (ROC)
+ abort and ensure mlink is properly passed during station removal,
+ preventing the NULL pointer dereference and deadlock during WiFi reset.
+
+ [ Test Plan ]
+
+ 1. Setup: A system with the MediaTek MT7925 (RZ717) Wi-Fi 7 adapter (e.g.
Framework Desktop AMD Ryzen AI Max 300 / Framework 16) running Ubuntu.
+ 2. Connect to a multi-band Wi-Fi network (2.4 / 5 / 6 GHz) and trigger rapid
roaming or forced AP re-association.
+ 3. Check system behavior:
+ - Without fix: Association failures trigger mt7925_mac_reset_work, leading
to NULL dereference in mt76_connac_mcu_uni_add_dev() and immediate hard freeze.
+ - With fix: WiFi disconnects, resets, and roaming complete cleanly. No
kernel panics, zero D-state tasks, and zero lockdep splats appear in dmesg.
+
+ [ Where problems could occur ]
+
+ The changes are strictly isolated to
+ drivers/net/wireless/mediatek/mt76/mt7925/.
+
+ They ensure mutex locking order is preserved during ROC abort and pass
+ valid station link structures. Regression risk is very low and
+ restricted exclusively to MT7925 wireless devices.
+
+ [ Other Info ]
+
+ - Upstream commits: Mainline Linux commits dd08ca3f092f and 9e4d518a4707.
+ - Target releases: Ubuntu 24.04 LTS (Noble linux-hwe-6.8), Ubuntu 25.10
(Questing linux 6.17), Ubuntu 26.04 (Resolute linux 7.0).
+ - User verification: Fix was verified and confirmed working by users across
6.17 and 7.0 kernel lines.
+
+ --- [ Original Report ]
+ (Refiling this bug with more data from `ubuntu-bug linux` and a correct title)
System experiences kernel panics causing complete lockups when the mt7925e
WiFi driver
attempts to reset after association failures.
Hardware: Framework Desktop (AMD Ryzen AI Max 300 Series)
BIOS: 03.04 (11/19/2025)
WiFi Card: MediaTek MT7925 (RZ717) Wi-Fi 7 at c0:00.0
Firmware: Build Time: 20250721232943
Root Cause:
NULL pointer dereference in mt76_connac_mcu_uni_add_dev() function at offset
0xba
during WiFi MAC reset workflow.
Crash Pattern:
1. WiFi association attempts fail/timeout with AP
2. Driver logs "Message timeout" errors (sequences 6-10)
3. mt7925_mac_reset_work initiated
4. During interface re-initialization via ieee80211_iterate_interfaces
5. mt76_connac_mcu_uni_add_dev attempts to dereference NULL pointer
6. Kernel panic - system completely locks up
Frequency: Multiple crashes per day, making system unusable
This appears to be a known issue affecting multiple users on Ubuntu 25.10
kernel 6.17.0-8 with this hardware.
ProblemType: Bug
DistroRelease: Ubuntu 25.10
Package: linux-image-6.17.0-8-generic 6.17.0-8.8
ProcVersionSignature: Ubuntu 6.17.0-8.8-generic 6.17.2
Uname: Linux 6.17.0-8-generic x86_64
ApportVersion: 2.33.1-0ubuntu3
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: gdm-greeter 6080 F.... wireplumber
/dev/snd/controlC0: gdm-greeter 6080 F.... wireplumber
/dev/snd/seq: gdm-greeter 6066 F.... pipewire
CasperMD5CheckResult: pass
Date: Tue Dec 30 17:36:29 2025
InstallationDate: Installed on 2025-11-30 (30 days ago)
InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007)
MachineType: Framework Desktop (AMD Ryzen AI Max 300 Series)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-ghostty
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.17.0-8-generic
root=UUID=7c001a2e-fa2b-447b-98ee-6322215addb9 ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
vt.handoff=7
RelatedPackageVersions:
firmware-sof N/A
linux-firmware 20250901.git993ff19b-0ubuntu1.4
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/19/2025
dmi.bios.release: 3.4
dmi.bios.vendor: INSYDE Corp.
dmi.bios.version: 03.04
dmi.board.asset.tag: *
dmi.board.name: FRANMFCP06
dmi.board.vendor: Framework
dmi.board.version: A6
dmi.chassis.asset.tag: FRAMDACPA65382007P
dmi.chassis.type: 35
dmi.chassis.vendor: Framework
dmi.chassis.version: A6
dmi.modalias:
dmi:bvnINSYDECorp.:bvr03.04:bd11/19/2025:br3.4:svnFramework:pnDesktop(AMDRyzenAIMax300Series):pvrA6:rvnFramework:rnFRANMFCP06:rvrA6:cvnFramework:ct35:cvrA6:skuFRAMDACP06:
dmi.product.family: Desktop
dmi.product.name: Desktop (AMD Ryzen AI Max 300 Series)
dmi.product.sku: FRAMDACP06
dmi.product.version: A6
dmi.sys.vendor: Framework
** Tags added: mt7925 noble resolute wifi
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2137291
Title:
mt7925e: Kernel panic NULL pointer dereference in
mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
