New situation. Firmware 0.1.48 version and kernel 6.12.90 combination, I
encountered different call trace in the kernel log with similar symptom.
```
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 8 PID: 161145 at lib/refcount.c:28
refcount_warn_saturate+0xbe/0x110
Modules linked in: sd_mod scsi_mod scsi_common snd_seq_dummy snd_hrtimer
snd_seq snd_seq_device ccm michael_mic rfcomm cmac qrtr_mhi algif_h>
cryptd videobuf2_common snd_acp_legacy_common think_lmi snd_ctl_led rapl
ecdh_generic mc firmware_attributes_class wmi_bmof snd_hda_core sn>
usb_common button fan wmi
CPU: 8 UID: 0 PID: 161145 Comm: kworker/8:2 Not tainted 6.12.90+deb13-amd64
#1 Debian 6.12.90-1
Hardware name: LENOVO 21K7SIT018/21K7SIT018, BIOS R2FET68W (1.48 )
01/28/2026
Workqueue: pm pm_runtime_work
RIP: 0010:refcount_warn_saturate+0xbe/0x110
Code: 01 01 e8 e5 67 a2 ff 0f 0b e9 49 7d 86 00 80 3d 14 f0 78 01 00 75 85
48 c7 c7 60 55 39 8f c6 05 04 f0 78 01 01 e8 c2 67 a2 ff <0f> 0b >
RSP: 0018:ffffcfac8039fac0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8cb24c6f5300 RCX: 0000000000000027
RDX: ffff8cb5ff021788 RSI: 0000000000000001 RDI: ffff8cb5ff021780
RBP: 0000000000000003 R08: 0000000000000000 R09: ffffcfac8039f940
R10: ffffffff8fab43e8 R11: 0000000000000003 R12: 0000000000000010
R13: 00000000ffffff92 R14: ffffcfac8039faf4 R15: ffff8cb24c6f5300
FS: 0000000000000000(0000) GS:ffff8cb5ff000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f34316d4000 CR3: 0000000271622000 CR4: 0000000000f50ef0
PKRU: 55555554
<TASK>
tb_cfg_request_put+0x5a/0x70 [thunderbolt]
tb_cfg_write_raw+0x1de/0x280 [thunderbolt]
tb_cfg_write+0x59/0xf0 [thunderbolt]
usb4_switch_set_wake+0x278/0x3d0 [thunderbolt]
tb_switch_suspend+0xdf/0x190 [thunderbolt]
tb_runtime_suspend+0x4b/0x70 [thunderbolt]
tb_domain_runtime_suspend+0x1f/0x40 [thunderbolt]
nhi_runtime_suspend+0x1e/0x50 [thunderbolt]
pci_pm_runtime_suspend+0x67/0x1a0
? __pfx_pci_pm_runtime_suspend+0x10/0x10
__rpm_callback+0x41/0x170
? __pfx_pci_pm_runtime_suspend+0x10/0x10
rpm_callback+0x55/0x60
? __pfx_pci_pm_runtime_suspend+0x10/0x10
rpm_suspend+0xe6/0x5f0
? finish_task_switch.isra.0+0x97/0x2c0
pm_runtime_work+0x98/0xb0
process_one_work+0x174/0x330
worker_thread+0x191/0x2f0
? __pfx_worker_thread+0x10/0x10
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
---[ end trace 0000000000000000 ]---
INFO: task gmain:206789 blocked for more than 120 seconds.
Tainted: G W 6.12.90+deb13-amd64 #1 Debian 6.12.90-1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:gmain state:D stack:0 pid:206789 tgid:206787 ppid:1
flags:0x00004002
Call Trace:
<TASK>
__schedule+0x505/0xc00
schedule+0x27/0xf0
schedule_timeout+0x12f/0x160
wait_for_completion+0x8a/0x160
__flush_work+0x269/0x350
? __pfx_wq_barrier_func+0x10/0x10
fsnotify_destroy_group+0x58/0x110
? task_work_run+0x59/0x90
inotify_release+0x18/0x50
__fput+0xde/0x2a0
task_work_run+0x59/0x90
do_exit+0x330/0xad0
do_group_exit+0x30/0x80
get_signal+0x87c/0x880
arch_do_signal_or_restart+0x3f/0x250
syscall_exit_to_user_mode+0x139/0x1b0
do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? eventfd_read+0xdf/0x230
? srso_alias_return_thunk+0x5/0xfbef5
? vfs_read+0x244/0x360
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
? srso_alias_return_thunk+0x5/0xfbef5
? syscall_exit_to_user_mode+0x37/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? syscall_exit_to_user_mode+0x37/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
? srso_alias_return_thunk+0x5/0xfbef5
? syscall_exit_to_user_mode+0x37/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fe96285d9ee
RSP: 002b:00007fe961c6cb78 EFLAGS: 00000246 ORIG_RAX: 000000000000010f
RAX: fffffffffffffdfe RBX: 00007fe961c6d6c0 RCX: 00007fe96285d9ee
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00007fe95c000b70
RBP: 000000007fffffff R08: 0000000000000008 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000002 R14: 00007fe95c000b70 R15: 0000000000000002
</TASK>
INFO: task kworker/u48:39:209431 blocked for more than 120 seconds.
Tainted: G W 6.12.90+deb13-amd64 #1 Debian 6.12.90-1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u48:39 state:D stack:0 pid:209431 tgid:209431 ppid:2
flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
<TASK>
__schedule+0x505/0xc00
schedule+0x27/0xf0
schedule_timeout+0x12f/0x160
wait_for_completion+0x8a/0x160
__synchronize_srcu+0x8e/0xc0
? __pfx_wakeme_after_rcu+0x10/0x10
? synchronize_srcu+0xc0/0xe0
fsnotify_mark_destroy_workfn+0x8c/0x130
process_one_work+0x174/0x330
worker_thread+0x191/0x2f0
? __pfx_worker_thread+0x10/0x10
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
.
PM: suspend entry (s2idle)
Filesystems sync: 0.020 seconds
Freezing user space processes
Freezing user space processes completed (elapsed 0.002 seconds)
OOM killer disabled.
Freezing remaining freezable tasks
Freezing remaining freezable tasks failed after 20.008 seconds (0 tasks
refusing to freeze, wq_busy=1):
Showing freezable workqueues that are still busy:
workqueue events_freezable: flags=0x4
pwq 22: cpus=5 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: pci_pme_list_scan
workqueue pm: flags=0x4
pwq 30: cpus=7 node=0 flags=0x0 nice=0 active=0 refcnt=2
inactive: pm_runtime_work
workqueue btrfs-endio-write: flags=0xe
pwq 48: cpus=0-11 flags=0x4 nice=0 active=0 refcnt=34
inactive: 33*btrfs_work_helper [btrfs]
pwq 48: cpus=0-11 flags=0x4 nice=0 active=0 refcnt=17
inactive: 16*btrfs_work_helper [btrfs]
Restarting kernel threads ... done.
OOM killer enabled.
Restarting tasks ... done.
```
The following 3 lines appeared multiple times in the kernel log:
```
Freezing remaining freezable tasks
Freezing remaining freezable tasks failed after 20.005 seconds (0 tasks
refusing to freeze, wq_busy=1):
Showing freezable workqueues that are still busy:
```
But this time by plugging/unplugging the USB-C power supply cable, the
screen would light up for around 20 seconds and I was able to interact with
the system, then the screen would go black again. This trick might also
work when I first encountered the problem but I had not tried that.
With that I was able to reboot back into 6.12.88 kernel version and since
then (2026-05-26 09:42:01 UTC+8) I went through a few suspend/resume and no
call trace in kernel log so far.
