[Bug 221521] New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[Bug 221521] New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

            Bug ID: 221521
           Summary: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl
                    (-22) on MediaTek MT7921 combo adapter
           Product: Drivers
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: blocking
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: txxlc@pm.me
        Regression: No

On kernel 7.0.7, the Bluetooth portion of the MediaTek MT7921 PCIe combo
adapter fails to initialize. The btusb driver detects the device (hci0), but
initialization aborts with:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)
As a result, bluetoothd starts successfully but reports no available
controllers. bluetoothctl list returns empty, and GUI managers (blueman,
bluedevil) cannot enable the adapter. RFKill shows no software/hardware blocks.
The Wi-Fi portion (mt7921e) initializes and works correctly.

Steps to Reproduce
    1. Boot system with kernel 7.0.7
    2. Check dmesg | grep -iE 'bluetooth|btusb|mt7921'
    3. Run bluetoothctl list
    4. Observe Failed to send wmt func ctrl (-22) in kernel log and No default
controller available in BlueZ

Relevant logs:
% sudo dmesg | grep -A2 -B2 'wmt func ctrl'
[    6.063435] input: HD-Audio Generic Mic as
/devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input16
[    6.063488] input: HD-Audio Generic Headphone as
/devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input17
[    6.078123] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
[    6.078129] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection
command is advertised, but not supported.
[    6.133913] mt7921e 0000:03:00.0: HW/SW Version: 0x8a108a10, Build Time:
20260224110909a

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Hardware|All                         |AMD

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Kernel Version|                            |7.0.7

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #1 from txxlc@pm.me ---
Extra info:

Kernel info:
Linux pc 7.0.7-arch1-1.1 #1 SMP PREEMPT_DYNAMIC Fri, 15 May 2026 00:50:13 +0000
x86_64 GNU/Linux

Hardware:
% lspci -nn | grep -i '03:00.0\|mt7921'
03:00.0 Network controller [0280]: MEDIATEK Corp. MT7921 802.11ax PCIe Wireless
Network Adapter [Filogic 330] [14c3:7961]

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|blocking                    |normal

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Piotr Beśka (abuson2@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abuson2@gmail.com

--- Comment #2 from Piotr Beśka (abuson2@gmail.com) ---
I can confirm the same regression on a MediaTek MT7925 PCIe Wi-Fi/Bluetooth
combo adapter.

Working:

* Linux 7.0.6-200.fc44.x86_64

Broken:

* Linux 7.0.7-200.fc44.x86_64

Firmware is unchanged between both tests:

* linux-firmware-20260410-1.fc44.noarch
* mt7xxx-firmware-20260410-1.fc44.noarch

Symptoms match this report:

* Wi-Fi works
* bluetoothd starts
* rfkill shows hci0, not blocked
* bluetoothctl reports: No default controller available

dmesg:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)


Booting back into 7.0.6 immediately restores Bluetooth. A full power cut does
not fix Bluetooth on 7.0.7.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

jill+kernel@kokakiwi.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jill+kernel@kokakiwi.net

--- Comment #3 from jill+kernel@kokakiwi.net ---
Confirming this regression on MediaTek MT7922 (`0e8d:0717`) on Arch Linux.

Broken: `7.0.7-zen2-1` (linux-zen) and `6.18.30-1-lts` (linux-lts)
Working: `7.0.6-zen1-1` (linux-zen)

Same symptom: `Bluetooth: hci0: Failed to send wmt func ctrl (-22)` immediately
at boot, Wi-Fi unaffected.

The regression field should be set to "Yes". Based on the 7.0.7 changelog, the
likely culprit is commit `634a4408c061` ("Bluetooth: btmtk: validate WMT event
SKB length before struct access"), which introduced `skb_pull_data()` length
validation in `btmtk_usb_hci_wmt_sync()`. The MT7922 appears to send a WMT
response that the new validation rejects as too short, causing `-EINVAL` before
the chip is ever enabled.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Bisected commit-id|                            |634a4408c061
         Regression|No                          |Yes

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |erpumper@gmail.com

--- Comment #4 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221511 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Bisected commit-id|634a4408c061                |634a4408c0615c523cf7531790f
                   |                            |4f14a422b9206
             Status|NEW                         |RESOLVED
                URL|                            |https://lore.kernel.org/all
                   |                            |/5i35wmc4z7sz54jo5uj6ywext2
                   |                            |enh4ik3oxmfmperqk2v5kc27@pp
                   |                            |vm6oodzipn/
         Resolution|---                         |CODE_FIX

--- Comment #5 from Artem S. Tashkinov (aros@gmx.com) ---
This commit should fix it:

https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/

Not yet pushed to stable but hopefully will be there in time for 7.0.8.

Keep an eye on
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-7.0

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |flavio.caetano@gmail.com

--- Comment #6 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221525 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #7 from erpumper@gmail.com ---
Hello I say kernel 7.1 rc error panel

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |autofire372@gmail.com

--- Comment #8 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221529 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sphinx-rift-sector@duck.com

--- Comment #9 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221539 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #10 from Artem S. Tashkinov (aros@gmx.com) ---
Kernel developers seemingly aren't interested in fixing this in stable. The fix
has been submitted only for 7.1. At least that's what I've learned from someone
involved.

Arch Linux has already incorporated the fix. If you use a different distro,
report to their bug tracker.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Jiri Slaby (jirislaby@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jirislaby@gmail.com

--- Comment #11 from Jiri Slaby (jirislaby@gmail.com) ---
It's not in linus/master, so cannot be in stable. Once it hits linus' tree,
stable will be poked to pick it up.

Meanwhile backporting to openSUSE.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.