Public bug reported: [Impact] WiFi is completely unusable as a client on devices with the Realtek RTL8723BS (SDIO) chipset running the 7.0 kernel shipped with Ubuntu 26.04 LTS. The device associates with the access point, but no data frames are transmitted: the WPA 4-way handshake times out, and on open networks DHCP never completes. dmesg is flooded with:
rtl8723bs mmc0:0001:1 wlan0: xmit_xmitframes: coalesce failed with error -22 This affects a large class of cheap Bay Trail / Cherry Trail laptops, tablets and ARM boards that ship this chipset. [System information] Ubuntu release: 26.04 LTS (resolute) Affected kernels: 7.0.0-14-generic, 7.0.0-30-generic (both reproduce) Working kernel: 7.1.9 (mainline, from kernel.ubuntu.com/mainline) Architecture: amd64 (32-bit UEFI firmware, 64-bit CPU) Hardware: Irbis NB11, Intel Atom Z3735F (Bay Trail-T) WiFi: Realtek RTL8723BS over SDIO, driver r8723bs (staging) [Steps to reproduce] 1. Boot Ubuntu 26.04 with kernel 7.0.0-x on RTL8723BS hardware. 2. Attempt to connect to any WPA2-PSK network. 3. Connection fails. NetworkManager reports "no-secrets" / wrong password, which is misleading — the passphrase is correct. [Actual behaviour] wpa_supplicant output shows association succeeding, then the handshake failing: wlan0: Associated with xx:xx:xx:xx:xx:xx wlan0: CTRL-EVENT-DISCONNECTED reason=0 locally_generated=1 wlan0: WPA: 4-Way Handshake failed - pre-shared key may be incorrect The same happens on an open (unencrypted) network: association succeeds, the link comes up, but DHCP never obtains an address. This confirms the problem is in the TX path, not in the crypto or the credentials. Management frames are transmitted fine (association works), which is why the failure only shows up once data frames need to be sent. [Root cause] Regression introduced by commit: bc4df274dca66a8f534feff5d3e1881f3c9b9bf6 "staging: rtl8723bs: update _rtw_pktfile_read() to return error codes" The commit changes _rtw_pktfile_read() to return -EINVAL when the remaining data is shorter than the requested length. Previously the function clamped the length. However, rtw_xmitframe_coalesce() legitimately requests more than the remaining length, so every such transmission now aborts with -EINVAL instead of sending a correctly clamped frame. [Fix] Fixed upstream; the fix is present in kernel 7.1.5 and later. Verified: installing mainline kernel 7.1.9 on the same machine, with no other changes, restores full WiFi functionality. No more "coalesce failed" messages, WPA2 connects normally, DHCP works. [Request] Please backport the upstream fix to the 7.0 kernel in 26.04 LTS. Users on this hardware currently have no supported option: there is no maintained out-of-tree driver for RTL8723BS (the code lives in staging), so the only workarounds are running an unsupported mainline kernel with no security updates, or buying a USB WiFi adapter. [Reference] Upstream discussion and confirmation that 7.1.5 contains the fix: https://bbs.archlinux.org/viewtopic.php?id=313401 ** Affects: linux (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2165019 Title: rtl8723bs: WiFi association succeeds but 4-way handshake and DHCP fail — "coalesce failed with error -22" (regression fixed upstream in 7.1.5) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165019/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
