New: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
https://bugzilla.kernel.org/show_bug.cgi?id=221521
Bug ID: 221521
Summary: Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl
(-22) on MediaTek MT7921 combo adapter
Product: Drivers
Version: 2.5
Hardware: All
OS: Linux
Status: NEW
Severity: blocking
Priority: P3
Component: Bluetooth
Assignee: [email protected]
Reporter: [email protected]
Regression: No
On kernel 7.0.7, the Bluetooth portion of the MediaTek MT7921 PCIe combo adapter fails to initialize. The btusb driver detects the device (hci0), but initialization aborts with:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)
As a result, bluetoothd starts successfully but reports no available controllers. bluetoothctl list returns empty, and GUI managers (blueman, bluedevil) cannot enable the adapter. RFKill shows no software/hardware blocks. The Wi-Fi portion (mt7921e) initializes and works correctly.
Steps to Reproduce
1. Boot system with kernel 7.0.7
2. Check dmesg | grep -iE 'bluetooth|btusb|mt7921'
3. Run bluetoothctl list
4. Observe Failed to send wmt func ctrl (-22) in kernel log and No default
controller available in BlueZ
Relevant logs:
% sudo dmesg | grep -A2 -B2 'wmt func ctrl'
[ 6.063435] input: HD-Audio Generic Mic as /devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input16 [ 6.063488] input: HD-Audio Generic Headphone as /devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input17 [ 6.078123] Bluetooth: hci0: Failed to send wmt func ctrl (-22) [ 6.078129] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. [ 6.133913] mt7921e 0000:03:00.0: HW/SW Version: 0x8a108a10, Build Time:
20260224110909a
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
https://bugzilla.kernel.org/show_bug.cgi?id=221521
[email protected] changed:
What |Removed |Added
----------------------------------------------------------------------------
Hardware|All |AMD
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
[email protected] changed:
What |Removed |Added
----------------------------------------------------------------------------
Kernel Version| |7.0.7
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
--- Comment #1 from [email protected] ---
Extra info:
Kernel info:
Linux pc 7.0.7-arch1-1.1 #1 SMP PREEMPT_DYNAMIC Fri, 15 May 2026 00:50:13 +0000 x86_64 GNU/Linux
Hardware:
% lspci -nn | grep -i '03:00.0\|mt7921'
03:00.0 Network controller [0280]: MEDIATEK Corp. MT7921 802.11ax PCIe Wireless Network Adapter [Filogic 330] [14c3:7961]
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
[email protected] changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|blocking |normal
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Piotr Beśka ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #2 from Piotr Beśka ([email protected]) ---
I can confirm the same regression on a MediaTek MT7925 PCIe Wi-Fi/Bluetooth combo adapter.
Working:
* Linux 7.0.6-200.fc44.x86_64
Broken:
* Linux 7.0.7-200.fc44.x86_64
Firmware is unchanged between both tests:
* linux-firmware-20260410-1.fc44.noarch
* mt7xxx-firmware-20260410-1.fc44.noarch
Symptoms match this report:
* Wi-Fi works
* bluetoothd starts
* rfkill shows hci0, not blocked
* bluetoothctl reports: No default controller available
dmesg:
Bluetooth: hci0: Failed to send wmt func ctrl (-22)
Booting back into 7.0.6 immediately restores Bluetooth. A full power cut does not fix Bluetooth on 7.0.7.
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
[email protected] changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #3 from [email protected] ---
Confirming this regression on MediaTek MT7922 (0e8d:0717) on Arch Linux.
Broken: 7.0.7-zen2-1 (linux-zen) and 6.18.30-1-lts (linux-lts)
Working: 7.0.6-zen1-1 (linux-zen)
Same symptom: Bluetooth: hci0: Failed to send wmt func ctrl (-22) immediately at boot, Wi-Fi unaffected.
The regression field should be set to "Yes". Based on the 7.0.7 changelog, the likely culprit is commit 634a4408c061 ("Bluetooth: btmtk: validate WMT event SKB length before struct access"), which introduced skb_pull_data() length validation in btmtk_usb_hci_wmt_sync(). The MT7922 appears to send a WMT response that the new validation rejects as too short, causing -EINVAL before the chip is ever enabled.
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
[email protected] changed:
What |Removed |Added
----------------------------------------------------------------------------
Bisected commit-id| |634a4408c061
Regression|No |YesSignature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #4 from Artem S. Tashkinov ([email protected]) --- *** Bug 221511 has been marked as a duplicate of this bug. ***
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
Bisected commit-id|634a4408c061 |634a4408c0615c523cf7531790f
| |4f14a422b9206
Status|NEW |RESOLVED
URL| |https://lore.kernel.org/all
| |/5i35wmc4z7sz54jo5uj6ywext2
| |enh4ik3oxmfmperqk2v5kc27@pp
| |vm6oodzipn/
Resolution|--- |CODE_FIX--- Comment #5 from Artem S. Tashkinov ([email protected]) --- This commit should fix it:
https://lore.kernel.org/all/770d36b07311bf88210c187923f243fb9f126f04.1777058551.git.pav@iki.fi/
Not yet pushed to stable but hopefully will be there in time for 7.0.8.
Keep an eye on
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-7.0
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #6 from Artem S. Tashkinov ([email protected]) --- *** Bug 221525 has been marked as a duplicate of this bug. ***
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
--- Comment #7 from [email protected] ---
Hello I say kernel 7.1 rc error panel
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #8 from Artem S. Tashkinov ([email protected]) --- *** Bug 221529 has been marked as a duplicate of this bug. ***
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #9 from Artem S. Tashkinov ([email protected]) --- *** Bug 221539 has been marked as a duplicate of this bug. ***
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
--- Comment #10 from Artem S. Tashkinov ([email protected]) ---
Kernel developers seemingly aren't interested in fixing this in stable. The fix has been submitted only for 7.1. At least that's what I've learned from someone involved.
Arch Linux has already incorporated the fix. If you use a different distro, report to their bug tracker.
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Jiri Slaby ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #11 from Jiri Slaby ([email protected]) ---
It's not in linus/master, so cannot be in stable. Once it hits linus' tree, stable will be poked to pick it up.
Meanwhile backporting to openSUSE.
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
--- Comment #12 from Artem S. Tashkinov ([email protected]) --- The patch has landed in 7.0.10. Hooray.
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #13 from Artem S. Tashkinov ([email protected]) --- *** Bug 221547 has been marked as a duplicate of this bug. ***
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Artem S. Tashkinov ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #14 from Artem S. Tashkinov ([email protected]) --- *** Bug 221576 has been marked as a duplicate of this bug. ***
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
Solarized ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #15 from Solarized ([email protected]) ---
repros on kernel 7.0.9 on Asus ProArt 7606WV (has mediatek wireless chip)
if you peak into kernel log using journalctl you will find this:
```plain Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: DSP1: cirrus/cs35l56-b0-dsp1-misc-10431e63-spkid1-amp1.bin (v1): v3.11.16 Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: DSP1: misc: C:\Users\gchen\Desktop\Asus_proj\CY24\MP\H7606W\240830\init\10431E63_240830_V1_A0-init.bin Jun 06 13:19:30 kernel: Bluetooth: hci0: Failed to send wmt func ctrl (-22) Jun 06 13:19:30 kernel: Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. Jun 06 13:19:30 kernel: zram0: detected capacity change from 0 to 33554432 Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.1: Calibration applied Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: Calibration applied Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.1: Tuning PID: 0x531116, SID: 0x201104, TID: 0x3c8830 Jun 06 13:19:30 kernel: cs35l56-hda i2c-CSC3556:00-cs35l56-hda.0: Tuning PID: 0x531116, SID: 0x201004, TID: 0x3c8830 Jun 06 13:19:31 kernel: NVRM: testIfDsmSubFunctionEnabled: GPS ACPI DSM called before _acpiDsmSupportedFuncCacheInit subfunction = 10. Jun 06 13:19:31 kernel: NVRM: testIfDsmSubFunctionEnabled: GPS ACPI DSM called before _acpiDsmSupportedFuncCacheInit subfunction = 11. Jun 06 13:19:31 kernel: [drm] Initialized nvidia-drm 0.0.0 for 0000:64:00.0 on minor 1 ```
which indicates broken bluetooth mediatek driver.
And, service log, shows following
```plain $ journalctl --boot --unit bluetooth.service Jun 06 13:19:29 systemd[1]: Starting bluetooth.service - Bluetooth service... Jun 06 13:19:29 (uetoothd)[1329]: bluetooth.service: ConfigurationDirectory 'bluetooth' already exists but the mode is different. (File system: 755 ConfigurationDirectoryMode: 555) Jun 06 13:19:29 bluetoothd[1329]: Bluetooth daemon 5.72 Jun 06 13:19:29 bluetoothd[1329]: Starting SDP server Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not support csip plugin Jun 06 13:19:29 bluetoothd[1329]: profiles/audio/micp.c:micp_init() D-Bus experimental not enabled Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not support micp plugin Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not support vcp plugin Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not support mcp plugin Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not support bass plugin Jun 06 13:19:29 bluetoothd[1329]: src/plugin.c:plugin_init() System does not support bap plugin Jun 06 13:19:29 bluetoothd[1329]: Bluetooth management interface 1.23 initialized Jun 06 13:19:29 systemd[1]: Started bluetooth.service - Bluetooth service. ```
Related:
-
https://lore.kernel.org/all/[email protected]/
-
https://www.reddit.com/r/linuxhardware/comments/1tfn5ev/mediatek_mt7921_bluetooth_not_initializing/
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
--- Comment #16 from Solarized ([email protected]) ---
* pertinent kernel module on this device is 'mt7925e'
```plain $ modinfo mt7925e filename: /lib/modules/6.18.7-76061807-generic/kernel/drivers/net/wireless/mediatek/mt76/mt7925/mt7925e.ko.zst license: Dual BSD/GPL description: MediaTek MT7925E (PCIe) wireless driver author: Lorenzo Bianconi <[email protected]> author: Deren Wu <[email protected]> firmware: mediatek/mt7925/WIFI_MT7925_PATCH_MCU_1_1_hdr.bin firmware: mediatek/mt7925/WIFI_RAM_CODE_MT7925_1_1.bin srcversion: A85F45784A6D298A162C62A alias: pci:v000014C3d00000717sv*sd*bc*sc*i* alias: pci:v000014C3d00007925sv*sd*bc*sc*i* depends: mt792x-lib,mt76-connac-lib,mt76,mt7925-common intree: Y name: mt7925e retpoline: Y vermagic: 6.18.7-76061807-generic SMP preempt mod_unload modversions ```
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
togaassorted ([email protected]) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #17 from togaassorted ([email protected]) --- You can see this if you use journalctl to view the kernel log.https://lore.kernel.org/all/[email protected]/
https://musicgames.io/sprunki-game
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
[email protected] changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #18 from [email protected] ---
I can reproduce this on another MT7921 system.
Hardware
Lenovo laptop
MT7921 PCIe Wireless Network Adapter
PCI ID: 14c3:7961
Bluetooth USB: 0489:e0cd
Distribution
Void Linux
Working kernel
6.12.74_1
Broken kernel
6.18.32_1
This is a regression.
Bluetooth works normally on Linux 6.12.74.
After booting Linux 6.18.32:
bluetoothctl list returns no controllers.
bluetoothctl show reports No default controller available. bluetui shows an empty interface because no controller is available.
The Bluetooth USB device is detected and bound to btusb, and /sys/class/bluetooth/hci0 exists.
Additional kernel messages after the initial error include:
Bluetooth: hci0: Execution of wmt command timed out
Bluetooth: hci0: Failed to send wmt patch dwnld (-110)
Bluetooth: hci0: Failed to set up firmware (-110)
Booting the already-installed 6.12.74 kernel immediately restores Bluetooth without changing firmware or userspace.
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
[Bug 221521] Bluetooth: btusb/mt7921 - Failed to send wmt func ctrl (-22) on MediaTek MT7921 combo adapter
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=221521
--- Comment #19 from Solarized ([email protected]) ---
Fixed on kernel-7.0.11
Signature · 4 lines
You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.