Public bug reported:
Ubuntu 26.10, kernels 7.3.0-9-generic and 7.3.0-10-generic.
Hardware: Teclast laptop (DMI "Teclast Default string", BIOS tPAD3.05
04/10/2024)
GPU: Intel Alder Lake-N iGPU (8086:46d2), i915, GuC 70.49.4, GuC submission
enabled
Wi-Fi: Realtek RTL8821CE (rtw88_8821ce)
PROBLEM
Launching Thunderbird (snap) causes a kernel panic ("Fatal exception in
interrupt") a few seconds later, nearly every time. It also happened once
while using Brave (snap). EFI pstore has kept the logs of more than a dozen
crashes since 2026-10-13; the 13 I checked all have the same signature.
The same symptom continues after updating to 7.3.0-10-generic.
STEPS TO REPRODUCE
1. Boot 7.3.0-9-generic or 7.3.0-10-generic.
2. Launch Thunderbird.
3. The system panics within a few seconds.
CRASH SIGNATURE (pstore, 7.3.0-9-generic)
WARNING: kernel/workqueue.c:2432 at __queue_work+0x422/0x540, CPU#1:
gfxtest/5832
delayed_work_timer_fn+0x19/0x30
call_timer_fn+0x30/0x160
__run_timers+0x1c0/0x2b0
run_timer_softirq+0x8a/0x100
handle_softirqs+0xd7/0x340
...
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
Oops: 0002 [#1] SMP NOPTI
RIP: 0010:__run_timers+0x1e9/0x2b0
RAX: dead000000000122 RDX: 0000000000000000 R13: ffff8d0243bc2a88
Kernel panic - not syncing: Fatal exception in interrupt
Across crashes the oops RIP is __run_timers+0x1e1, +0x1e9 or +0x1f1.
In detach_timer() the timer being removed already has entry.next ==
LIST_POISON2 and entry.pprev == NULL: a timer that was already detached
is still linked in the timer wheel. R13 in the oops is exactly 0x20 after
RBX in the preceding WARN (ffff8d0243bc2a68), so it appears to be the
timer of the same delayed_work. This looks like a delayed_work being freed
or re-initialized while still pending (use-after-free).
The task running at the time was "gfxtest", a short-lived process that
appears to be started by Thunderbird at launch to probe the GPU. That makes
i915 a suspect, but it is not confirmed.
ALREADY TESTED (crash still happens)
- Airplane mode (Wi-Fi off)
- options rtw88_pci disable_aspm=1
- LIBGL_ALWAYS_SOFTWARE=1 thunderbird
NOT TESTED YET
- Booting with nomodeset
- An older kernel
The full pstore log of the latest crash is attached.
ProblemType: Bug
DistroRelease: Ubuntu 26.10
Package: linux-image-7.3.0-10-generic 7.3.0-10.10
ProcVersionSignature: Ubuntu 7.3.0-10.10-generic 7.3.0
Uname: Linux 7.3.0-10-generic x86_64
ApportVersion: 2.36.0-0ubuntu1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: henry-crisbeth 2984 F.... wireplumber
/dev/snd/seq: henry-crisbeth 2980 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sun Nov 1 09:27:35 2026
InstallationDate: Installed on 2025-06-23 (496 days ago)
InstallationMedia: Ubuntu 24.04.2 LTS "Noble Numbat" - Release amd64 (20250215)
Lsusb:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 062a:9013 MosArt Semiconductor Corp. 2.4G Keyboard Mouse
Bus 001 Device 003: ID b349:b181 KYT-240222-A USB Camera
Bus 001 Device 004: ID 0bda:c821 Realtek Semiconductor Corp. Bluetooth Radio
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
MachineType: Teclast Default string
ProcEnviron:
LANG=es_ES.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.3.0-10-generic
root=UUID=01057e0e-86fe-4455-994c-88065f563a6d ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: Upgraded to stonking on 2026-09-29 (33 days ago)
dmi.bios.date: 04/10/2024
dmi.bios.release: 5.27
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: tPAD3.05
dmi.board.asset.tag: Default string
dmi.board.version: Default string
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 10
dmi.chassis.vendor: Default string
dmi.chassis.version: Default string
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrtPAD3.05:bd04/10/2024:br5.27:svnTeclast:pnDefaultstring:pvrDefaultstring:rvn:rn:rvrDefaultstring:cvnDefaultstring:ct10:cvrDefaultstring:skuF1P2_A1:pfa:
dmi.product.name: Default string
dmi.product.sku: F1P2_A1
dmi.product.version: Default string
dmi.sys.vendor: Teclast
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug stonking third-party-packages wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172702
Title:
Kernel panic in __run_timers (timer list corruption) when launching
Thunderbird on Alder Lake-N, 7.3.0-9 and 7.3.0-10
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172702/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
