[Bug 221521] New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[Bug 221521] New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

            Bug ID: 221521
           Summary: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl
                    (-22) on MediaTek MT7921 combo adapter
           Product: Drivers
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: blocking
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: txxlc@pm.me
        Regression: No

On kernel 7.0.7, the Bluetooth portion of the MediaTek MT7921 PCIe combo
adapter fails to initialize. The btusb driver detects the device (hci0), but
initialization aborts with:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)
As a result, bluetoothd starts successfully but reports no available
controllers. bluetoothctl list returns empty, and GUI managers (blueman,
bluedevil) cannot enable the adapter. RFKill shows no software/hardware blocks.
The Wi-Fi portion (mt7921e) initializes and works correctly.

Steps to Reproduce
    1. Boot system with kernel 7.0.7
    2. Check dmesg | grep -iE 'bluetooth|btusb|mt7921'
    3. Run bluetoothctl list
    4. Observe Failed to send wmt func ctrl (-22) in kernel log and No default
controller available in BlueZ

Relevant logs:
% sudo dmesg | grep -A2 -B2 'wmt func ctrl'
[    6.063435] input: HD-Audio Generic Mic as
/devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input16
[    6.063488] input: HD-Audio Generic Headphone as
/devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input17
[    6.078123] Bluetooth: hci0: Failed to send wmt func ctrl (-22)
[    6.078129] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection
command is advertised, but not supported.
[    6.133913] mt7921e 0000:03:00.0: HW/SW Version: 0x8a108a10, Build Time:
20260224110909a

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Hardware|All                         |AMD

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Kernel Version|                            |7.0.7

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #1 from txxlc@pm.me ---
Extra info:

Kernel info:
Linux pc 7.0.7-arch1-1.1 #1 SMP PREEMPT_DYNAMIC Fri, 15 May 2026 00:50:13 +0000
x86_64 GNU/Linux

Hardware:
% lspci -nn | grep -i '03:00.0\|mt7921'
03:00.0 Network controller [0280]: MEDIATEK Corp. MT7921 802.11ax PCIe Wireless
Network Adapter [Filogic 330] [14c3:7961]

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|blocking                    |normal

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Piotr Beśka (abuson2@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abuson2@gmail.com

--- Comment #2 from Piotr Beśka (abuson2@gmail.com) ---
I can confirm the same regression on a MediaTek MT7925 PCIe Wi-Fi/Bluetooth
combo adapter.

Working:

* Linux 7.0.6-200.fc44.x86_64

Broken:

* Linux 7.0.7-200.fc44.x86_64

Firmware is unchanged between both tests:

* linux-firmware-20260410-1.fc44.noarch
* mt7xxx-firmware-20260410-1.fc44.noarch

Symptoms match this report:

* Wi-Fi works
* bluetoothd starts
* rfkill shows hci0, not blocked
* bluetoothctl reports: No default controller available

dmesg:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)


Booting back into 7.0.6 immediately restores Bluetooth. A full power cut does
not fix Bluetooth on 7.0.7.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

jill+kernel@kokakiwi.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jill+kernel@kokakiwi.net

--- Comment #3 from jill+kernel@kokakiwi.net ---
Confirming this regression on MediaTek MT7922 (`0e8d:0717`) on Arch Linux.

Broken: `7.0.7-zen2-1` (linux-zen) and `6.18.30-1-lts` (linux-lts)
Working: `7.0.6-zen1-1` (linux-zen)

Same symptom: `Bluetooth: hci0: Failed to send wmt func ctrl (-22)` immediately
at boot, Wi-Fi unaffected.

The regression field should be set to "Yes". Based on the 7.0.7 changelog, the
likely culprit is commit `634a4408c061` ("Bluetooth: btmtk: validate WMT event
SKB length before struct access"), which introduced `skb_pull_data()` length
validation in `btmtk_usb_hci_wmt_sync()`. The MT7922 appears to send a WMT
response that the new validation rejects as too short, causing `-EINVAL` before
the chip is ever enabled.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

txxlc@pm.me changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Bisected commit-id|                            |634a4408c061
         Regression|No                          |Yes

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |erpumper@gmail.com

--- Comment #4 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221511 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Bisected commit-id|634a4408c061                |634a4408c0615c523cf7531790f
                   |                            |4f14a422b9206
             Status|NEW                         |RESOLVED
                URL|                            |https://lore.kernel.org/all
                   |                            |/5i35wmc4z7sz54jo5uj6ywext2
                   |                            |enh4ik3oxmfmperqk2v5kc27@pp
                   |                            |vm6oodzipn/
         Resolution|---                         |CODE_FIX

--- Comment #5 from Artem S. Tashkinov (aros@gmx.com) ---
This commit should fix it:

https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/

Not yet pushed to stable but hopefully will be there in time for 7.0.8.

Keep an eye on
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-7.0

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |flavio.caetano@gmail.com

--- Comment #6 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221525 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #7 from erpumper@gmail.com ---
Hello I say kernel 7.1 rc error panel

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |autofire372@gmail.com

--- Comment #8 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221529 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sphinx-rift-sector@duck.com

--- Comment #9 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221539 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #10 from Artem S. Tashkinov (aros@gmx.com) ---
Kernel developers seemingly aren't interested in fixing this in stable. The fix
has been submitted only for 7.1. At least that's what I've learned from someone
involved.

Arch Linux has already incorporated the fix. If you use a different distro,
report to their bug tracker.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Jiri Slaby (jirislaby@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jirislaby@gmail.com

--- Comment #11 from Jiri Slaby (jirislaby@gmail.com) ---
It's not in linus/master, so cannot be in stable. Once it hits linus' tree,
stable will be poked to pick it up.

Meanwhile backporting to openSUSE.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #12 from Artem S. Tashkinov (aros@gmx.com) ---
The patch has landed in 7.0.10. Hooray.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |olle@vixit.nu

--- Comment #13 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221547 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Artem S. Tashkinov (aros@gmx.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sergey@batalov.email

--- Comment #14 from Artem S. Tashkinov (aros@gmx.com) ---
*** Bug 221576 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

Solarized (p@atiq.xyz) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |p@atiq.xyz

--- Comment #15 from Solarized (p@atiq.xyz) ---
repros on kernel 7.0.9 on Asus ProArt 7606WV (has mediatek wireless chip)

if you peak into kernel log using `journalctl` you will find this:

```plain
Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: DSP1:
cirrus/cs35l56-b0-dsp1-misc-10431e63-spkid1-amp1.bin (v1): v3.11.16
Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: DSP1: misc:
C:\Users\gchen\Desktop\Asus_proj\CY24\MP\H7606W\240830\init\10431E63_240830_V1_A0-init.bin
Jun 06 13:19:30 kernel: Bluetooth: hci0: Failed to send wmt func ctrl (-22)
Jun 06 13:19:30 kernel: Bluetooth: hci0: HCI Enhanced Setup Synchronous
Connection command is advertised, but not supported.
Jun 06 13:19:30 kernel: zram0: detected capacity change from 0 to 33554432
Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.1: Calibration
applied
Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: Calibration
applied
Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.1: Tuning PID:
0x531116, SID: 0x201104, TID: 0x3c8830
Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: Tuning PID:
0x531116, SID: 0x201004, TID: 0x3c8830
Jun 06 13:19:31 kernel: NVRM: testIfDsmSubFunctionEnabled: GPS ACPI DSM called
before _acpiDsmSupportedFuncCacheInit subfunction = 10.
Jun 06 13:19:31 kernel: NVRM: testIfDsmSubFunctionEnabled: GPS ACPI DSM called
before _acpiDsmSupportedFuncCacheInit subfunction = 11.
Jun 06 13:19:31 kernel: [drm] Initialized nvidia-drm 0.0.0 for 0000:64:00.0 on
minor 1

```
which indicates broken bluetooth mediatek driver.


And, service log, shows following

```plain
$ journalctl --boot --unit bluetooth.service
Jun 06 13:19:29 systemd[1]: Starting bluetooth.service - Bluetooth service...
Jun 06 13:19:29 (uetoothd)[1329]: bluetooth.service: ConfigurationDirectory
'bluetooth' already exists but the mode is different. (File system: 755
ConfigurationDirectoryMode: 555)
Jun 06 13:19:29 bluetoothd[1329]: Bluetooth daemon 5.72
Jun 06 13:19:29 bluetoothd[1329]: Starting SDP server
Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not
support csip plugin
Jun 06 13:19:29 bluetoothd[1329]: profiles/audio/micp.c:micp_init() D-Bus
experimental not enabled
Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not
support micp plugin
Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not
support vcp plugin
Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not
support mcp plugin
Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not
support bass plugin
Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not
support bap plugin
Jun 06 13:19:29 bluetoothd[1329]: Bluetooth management interface 1.23
initialized
Jun 06 13:19:29 systemd[1]: Started bluetooth.service - Bluetooth service.
```

Related:
-
https://lore.kernel.org/all/81bcf9fd-2f07-4fc6-be90-da4e448379e4@leemhuis.info/
-
https://www.reddit.com/r/linuxhardware/comments/1tfn5ev/mediatek_mt7921_bluetooth_not_initializing/

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221521

--- Comment #16 from Solarized (p@atiq.xyz) ---
* pertinent kernel module on this device is 'mt7925e'

```plain
$ modinfo mt7925e
filename:      
/lib/modules/6.18.7-76061807-generic/kernel/drivers/net/wireless/mediatek/mt76/mt7925/mt7925e.ko.zst
license:        Dual BSD/GPL
description:    MediaTek MT7925E (PCIe) wireless driver
author:         Lorenzo Bianconi <lorenzo@kernel.org>
author:         Deren Wu <deren.wu@mediatek.com>
firmware:       mediatek/mt7925/WIFI_MT7925_PATCH_MCU_1_1_hdr.bin
firmware:       mediatek/mt7925/WIFI_RAM_CODE_MT7925_1_1.bin
srcversion:     A85F45784A6D298A162C62A
alias:          pci:v000014C3d00000717sv*sd*bc*sc*i*
alias:          pci:v000014C3d00007925sv*sd*bc*sc*i*
depends:        mt792x-lib,mt76-connac-lib,mt76,mt7925-common
intree:         Y
name:           mt7925e
retpoline:      Y
vermagic:       6.18.7-76061807-generic SMP preempt mod_unload modversions
```

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.