** Description changed:
[ Impact ]
Systems using the MediaTek MT7925 (RZ717) Wi-Fi 7 chipset suffer from
- intermittent kernel panics and hard system lockups during AP roaming,
- multi-link operations (MLO), or connection resets.
+ intermittent kernel panics and complete system lockups during Wi-Fi MAC
+ reset recovery (mt7925_mac_reset_work).
- The failure manifests as an AB-BA deadlock between cfg80211_wiphy_work
- and mt7925_roc_work, where cancel_work_sync() is invoked while holding
- the mt76 mutex, followed by a NULL pointer dereference in
- mt76_connac_mcu_uni_add_dev() during interface re-initialization.
+ The crash occurs when mt7925_vif_connect_iter() iterates over links
+ tracked in mvif->valid_links. After MLO link changes or MCU timeout
+ recovery, the driver bitmap can temporarily contain a link whose
+ mac80211 bss_conf has already been removed. The function passes a NULL
+ bss_conf pointer (register x1 = 0x0) into mt76_connac_mcu_uni_add_dev(),
+ resulting in an immediate NULL pointer dereference kernel panic:
- Once triggered, the kernel wedges, wpa_supplicant hangs in
- uninterruptible sleep (D state), and the system completely freezes,
- requiring a hard power cycle.
+ pc : mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib]
+ lr : mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common]
+ x2 : ffffff80a77f6018 x1 : 0000000000000000 x0 : ffffff8099402080
+ Call trace:
+ mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib]
+ mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common]
+ mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common]
+
+ Once triggered, the kernel panics and freezes the machine, requiring a
+ physical power cycle. This affects multiple users on Framework Laptop
+ 16, Framework Desktop AMD Ryzen AI Max, and ONEXPLAYER handhelds.
[ Fix ]
- Backport the two upstream fixes merged into mainline Linux:
- - dd08ca3f092f ("wifi: mt76: mt7925: fix potential deadlock in
mt7925_roc_abort_sync")
- - 9e4d518a4707 ("wifi: mt76: mt7925: pass mlink to mac_link_sta_remove()")
+ Backport upstream Linux commit:
+ - bd8b2ec83818 ("wifi: mt76: mt7925: fix crash in reset link replay")
- These commits fix the mutex locking order during remain-on-channel (ROC)
- abort and ensure mlink is properly passed during station removal,
- preventing the NULL pointer dereference and deadlock during WiFi reset.
+ This surgical fix checks the bss_conf pointer returned by
+ mt792x_vif_to_bss_conf(vif, i) and skips missing entries (if (!bss_conf)
+ continue;) before replaying the link to the firmware. Non-MLO AP/STA
+ reset replay remains unchanged.
[ Test Plan ]
- 1. Setup: A system with the MediaTek MT7925 (RZ717) Wi-Fi 7 adapter (e.g.
Framework Desktop AMD Ryzen AI Max 300 / Framework 16) running Ubuntu.
- 2. Connect to a multi-band Wi-Fi network (2.4 / 5 / 6 GHz) and trigger rapid
roaming or forced AP re-association.
- 3. Check system behavior:
- - Without fix: Association failures trigger mt7925_mac_reset_work, leading
to NULL dereference in mt76_connac_mcu_uni_add_dev() and immediate hard freeze.
- - With fix: WiFi disconnects, resets, and roaming complete cleanly. No
kernel panics, zero D-state tasks, and zero lockdep splats appear in dmesg.
+ 1. Setup: A system equipped with a MediaTek MT7925 (RZ717) Wi-Fi 7 PCI
adapter (e.g. Framework Desktop AMD Ryzen AI Max 300 / Framework 16) running
Ubuntu.
+ 2. Connect to an AP and trigger repeated Wi-Fi reset conditions (e.g. forced
AP deauthentication, association timeout injection, or rapid roaming across
2.4/5/6 GHz bands).
+ 3. Observe system behavior during mt7925_mac_reset_work:
+ - Without fix: System triggers mt7925_mac_reset_work, dereferences NULL
bss_conf in mt76_connac_mcu_uni_add_dev, and hard freezes in kernel panic.
+ - With fix: Driver skips non-existent bss_conf entries, link replay
finishes cleanly, Wi-Fi recovers connection, and 0 kernel oops or panic traces
appear in dmesg.
[ Where problems could occur ]
- The changes are strictly isolated to
- drivers/net/wireless/mediatek/mt76/mt7925/.
-
- They ensure mutex locking order is preserved during ROC abort and pass
- valid station link structures. Regression risk is very low and
- restricted exclusively to MT7925 wireless devices.
+ The fix is minimal (3 lines added in
+ drivers/net/wireless/mediatek/mt76/mt7925/mac.c). It is strictly scoped
+ to the MT7925 driver reset worker. It only skips NULL bss_conf pointers
+ that would otherwise crash the kernel. Regression risk is very low and
+ restricted exclusively to MediaTek MT7925 wireless devices.
[ Other Info ]
- - Upstream commits: Mainline Linux commits dd08ca3f092f and 9e4d518a4707.
- - Target releases: Ubuntu 24.04 LTS (Noble linux-hwe-6.8), Ubuntu 25.10
(Questing linux 6.17), Ubuntu 26.04 (Resolute linux 7.0).
- - User verification: Fix was verified and confirmed working by users across
6.17 and 7.0 kernel lines.
+ - Upstream commit: Mainline Linux commit bd8b2ec83818 ("wifi: mt76: mt7925:
fix crash in reset link replay") by Sean Wang (MediaTek).
+ - Target releases:
+ - Ubuntu 26.04 (Resolute linux 7.0)
+ - Ubuntu 24.04 LTS (Noble linux-hwe-7.0, linux-hwe-6.8)
+ - Ubuntu 25.10 (Questing linux 6.17)
+ - Scope clarification:
+ 1. The separate ROC deadlock issue was fixed by upstream commit
dd08ca3f092f ("wifi: mt76: mt7925: fix potential deadlock in
mt7925_roc_abort_sync"), which is already present in Ubuntu 7.0 kernels since
7.0.0-28.28.
+ 2. Upstream commit 9e4d518a4707 ("wifi: mt76: mt7925: pass mlink to
mac_link_sta_remove()") is deliberately EXCLUDED as it does not address this
crash and causes an MLO connectivity-stall regression.
+ 3. This SRU specifically delivers the missing reset link replay NULL
dereference fix (bd8b2ec83818).
--- [ Original Report ]
(Refiling this bug with more data from `ubuntu-bug linux` and a correct title)
System experiences kernel panics causing complete lockups when the mt7925e
WiFi driver
attempts to reset after association failures.
Hardware: Framework Desktop (AMD Ryzen AI Max 300 Series)
BIOS: 03.04 (11/19/2025)
WiFi Card: MediaTek MT7925 (RZ717) Wi-Fi 7 at c0:00.0
Firmware: Build Time: 20250721232943
Root Cause:
NULL pointer dereference in mt76_connac_mcu_uni_add_dev() function at offset
0xba
during WiFi MAC reset workflow.
Crash Pattern:
1. WiFi association attempts fail/timeout with AP
2. Driver logs "Message timeout" errors (sequences 6-10)
3. mt7925_mac_reset_work initiated
4. During interface re-initialization via ieee80211_iterate_interfaces
5. mt76_connac_mcu_uni_add_dev attempts to dereference NULL pointer
6. Kernel panic - system completely locks up
Frequency: Multiple crashes per day, making system unusable
This appears to be a known issue affecting multiple users on Ubuntu 25.10
kernel 6.17.0-8 with this hardware.
ProblemType: Bug
DistroRelease: Ubuntu 25.10
Package: linux-image-6.17.0-8-generic 6.17.0-8.8
ProcVersionSignature: Ubuntu 6.17.0-8.8-generic 6.17.2
Uname: Linux 6.17.0-8-generic x86_64
ApportVersion: 2.33.1-0ubuntu3
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: gdm-greeter 6080 F.... wireplumber
/dev/snd/controlC0: gdm-greeter 6080 F.... wireplumber
/dev/snd/seq: gdm-greeter 6066 F.... pipewire
CasperMD5CheckResult: pass
Date: Tue Dec 30 17:36:29 2025
InstallationDate: Installed on 2025-11-30 (30 days ago)
InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007)
MachineType: Framework Desktop (AMD Ryzen AI Max 300 Series)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-ghostty
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.17.0-8-generic
root=UUID=7c001a2e-fa2b-447b-98ee-6322215addb9 ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
vt.handoff=7
RelatedPackageVersions:
firmware-sof N/A
linux-firmware 20250901.git993ff19b-0ubuntu1.4
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/19/2025
dmi.bios.release: 3.4
dmi.bios.vendor: INSYDE Corp.
dmi.bios.version: 03.04
dmi.board.asset.tag: *
dmi.board.name: FRANMFCP06
dmi.board.vendor: Framework
dmi.board.version: A6
dmi.chassis.asset.tag: FRAMDACPA65382007P
dmi.chassis.type: 35
dmi.chassis.vendor: Framework
dmi.chassis.version: A6
dmi.modalias:
dmi:bvnINSYDECorp.:bvr03.04:bd11/19/2025:br3.4:svnFramework:pnDesktop(AMDRyzenAIMax300Series):pvrA6:rvnFramework:rnFRANMFCP06:rvrA6:cvnFramework:ct35:cvrA6:skuFRAMDACP06:
dmi.product.family: Desktop
dmi.product.name: Desktop (AMD Ryzen AI Max 300 Series)
dmi.product.sku: FRAMDACP06
dmi.product.version: A6
dmi.sys.vendor: Framework
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2137291
Title:
mt7925e: Kernel panic NULL pointer dereference in
mt76_connac_mcu_uni_add_dev during WiFi reset - Framework Desktop
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2137291/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
