Public bug reported:
Regression in kernel 7.0.0-31-generic (Ubuntu 26.04 "resolute"): a single
btusb URB failure on a Realtek RTL8761BU dongle (USB ID 0bda:a729) turns into a
permanent 30-second USB reset storm that never self-recovers. The identical
fault on kernel 6.8.0-137/-138/-139 self-recovered within ~4 minutes.
Hardware / OS
-------------
Machine: MSI MS-7971, x86_64
Bluetooth adapter: Realtek RTL8761BU (lsusb: 0bda:a729), sysfs path 1-1, USB
full-speed
Firmware: /lib/firmware/rtl_bt/rtl8761bu_fw.bin, version 0xdfc6d922,
file mtime 2026-06-24 -- UNCHANGED across the 24.04 -> 26.04 upgrade,
so the kernel is the only changed variable.
Distribution upgrade performed: Ubuntu 24.04 (noble) -> 26.04 (resolute),
2026-09-10 09:29-09:45.
Impact
------
The dongle is the only Bluetooth adapter on a Home Assistant server, driving
four
BLE ventilation units. Once the storm starts, all BLE devices become permanently
unavailable until the machine (or at minimum the userspace Bluetooth scanner) is
restarted. Observed 4 consecutive days of continuous failure, ~1500 resets.
Evidence: A/B measurement across boots
--------------------------------------
Counted with `journalctl -b <N> -k | grep -c ...` for each boot recorded in
`journalctl --list-boots`.
Boot | Kernel | "failed to resubmit" | "reset full-speed USB device"
| Span
-4 | 6.8.0-137-generic | 9 | 10
| Aug 11 - Aug 24 (13 d)
-3 | 6.8.0-138-generic | 8 | 9
| Aug 24 - Sep 6 (13 d)
-2 | 6.8.0-139-generic | 0 | 1
| Sep 6 - Sep 10 (4 d)
-1 | 6.8.0-139-generic | 1 | 1
| Sep 10, 23 min
0 | 7.0.0-31-generic | 1504 | 1702
| Sep 10 - Sep 13 (3.4 d)
The baseline URB glitch rate is comparable (~1/day) on 6.8 and on 7.0. What
changed is RECOVERY. Example of self-recovery on 6.8.0-138 (storm starts, ends,
and never returns for the rest of that 13-day boot):
Sep 03 11:26:49 kernel: Bluetooth: hci0: command 0x2042 tx timeout
Sep 03 11:26:51 kernel: Bluetooth: hci0: Resetting usb device.
Sep 03 11:28:57 kernel: Bluetooth: hci1: urb 000000005459b154 failed to
resubmit (2)
... (8 such events, exactly 30 s apart) ...
Sep 03 11:32:27 kernel: Bluetooth: hci1: urb 00000000f522c0d9 failed to
resubmit (2)
[no further occurrence for the remaining ~10 days of this boot]
On 7.0.0-31 the same pattern does not terminate. It ran continuously for over
13 hours (first event 2026-09-13 06:36:48, still looping at 20:52 the same day)
at a strict 30-second period, reloading the firmware each cycle:
Sep 13 06:36:48 kernel: Bluetooth: hci1: urb 000000007d46fa94 failed to
resubmit (2)
Sep 13 06:36:48 kernel: usb 1-1: reset full-speed USB device number 2 using
xhci_hcd
Sep 13 06:36:48 kernel: Bluetooth: hci0: RTL: examining hci_ver=0a
hci_rev=dfc6 ...
Sep 13 06:36:49 kernel: Bluetooth: hci0: RTL: btrtl_initialize: key id 0
Sep 13 06:36:49 kernel: Bluetooth: hci0: RTL: loading rtl_bt/rtl8761bu_fw.bin
Sep 13 06:36:49 kernel: Bluetooth: hci0: RTL: fw version 0xdfc6d922
Sep 13 06:37:18 kernel: Bluetooth: hci0: urb 000000002b074a10 failed to
resubmit (2)
Sep 13 06:37:18 kernel: usb 1-1: reset full-speed USB device number 2 using
xhci_hcd
[repeats every 30 s indefinitely]
Other failing opcodes seen on 7.0.0-31, all -110 (ETIMEDOUT):
Opcode 0x2005 failed: -110 / command 0x2005 tx timeout (first one 19 s
after boot)
Opcode 0x2041 failed: -110
Opcode 0x2011 failed: -110 / Unable to add to allow list: -110
Opcode 0x2013 failed: -107 / -16
command 0xfc61 tx timeout
start background scanning failed: -110
Note the very first error of the whole failure history appeared 19 seconds after
the first boot into 7.0.0-31 (2026-09-10 09:47:49, boot at 09:47:30), and there
is no comparable storm anywhere in the preceding month of 6.8 boots.
Why hardware recovery cannot break the loop
-------------------------------------------
This RTL8761BU board has no reset GPIO line (the "Realtek 8761 BU without reset
pin" case, cf. home-assistant/core#133080). The driver's btusb_rtl_cmd_timeout()
GPIO-based recovery path therefore cannot fire, leaving the USB reset / URB
resubmit path as the only recovery mechanism -- and on 7.0.0-31 that path never
succeeds, so the device is re-probed and re-fails forever.
Secondary effect: HCI index migration
-------------------------------------
Each cycle the adapter re-registers, sometimes under a different index
(hci0 -> hci1 -> hci0 ...). Long-running userspace pinned to the old index then
fails permanently with:
BleakError: adapter 'hci1' not found
This is what makes the failure unrecoverable from userspace without a
restart.
Hypotheses already tested and ruled out
---------------------------------------
1. USB runtime power management / autosuspend -- NOT the cause.
With autosuspend fully disabled (power/autosuspend_delay_ms = -1,
power/control = on, and `options btusb enable_autosuspend=0` in
/etc/modprobe.d), the storm continued at the same 30 s period:
20:46:31 kernel: Bluetooth: hci0: urb 000000003c604a82 failed to resubmit
(2)
20:46:32 kernel: usb 1-1: reset full-speed USB device number 2 using
xhci_hcd
20:47:01 kernel: Bluetooth: hci0: urb 0000000092461d56 failed to resubmit
(2)
20:47:02 kernel: usb 1-1: reset full-speed USB device number 2 using
xhci_hcd
(9 errors in a 150 s observation window with autosuspend off)
2. Firmware change -- ruled out, firmware files untouched since 2026-06-24.
3. USB unbind/bind of 1-1 -- only relieves it for a few minutes, then it
returns.
What does recover
-----------------
Restarting the userspace Bluetooth scanner (docker restart of the Home Assistant
container) re-pins it to the live hciN. Verified clean afterwards:
kernel BT errors in 180 s window: 0
hciconfig: hci0 UP RUNNING, RX bytes 529650 -> 2228362 and growing, acl:55,
errors:0
all four BLE devices reconnect and complete GATT transactions.
This is a workaround, not a fix: the kernel never recovers the adapter on its
own
and will enter the storm again.
Expected vs actual
------------------
Expected: an RTL8761BU URB/opcode timeout is retried and the adapter recovers,
as it did on 6.8.0-137/138/139.
Actual: on 7.0.0-31 the adapter is stuck in an infinite 30 s probe-reset loop
that only a userspace restart (or reboot) can clear.
[Reporter note] The CurrentDmesg attached to this report was reconstructed from
the persistent journal of the affected boot (journalctl -b -1 -k, kernel
7.0.0-31-generic), because the original apport run could not execute 'pkexec
dmesg' on the headless server (no auth agent / TTY, exit 127), so CurrentDmesg
came back as an error string instead of the log. The reconstructed output is
authentic dmesg format ([timestamp] message). The server was subsequently
rolled back to 6.8.0-139-generic to stop the storm, so a live capture on
7.0.0-31 is no longer possible; this journal capture is the faithful record of
the failing boot.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-31-generic 7.0.0-31.31
ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
Uname: Linux 7.0.0-31-generic x86_64
NonfreeKernelModules: zfs
AlsaVersion: Advanced Linux Sound Architecture Driver Version k7.0.0-31-generic.
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path',
'/dev/snd/controlC0', '/dev/snd/hwC0D2', '/dev/snd/hwC0D0',
'/dev/snd/pcmC0D8p', '/dev/snd/pcmC0D7p', '/dev/snd/pcmC0D3p',
'/dev/snd/pcmC0D2c', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq',
'/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
CasperMD5CheckResult: unknown
Date: Sun Sep 13 21:34:49 2026
InstallationDate: Installed on 2026-01-28 (228 days ago)
InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64
(20250805.1)
Lsusb:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0bda:a729 Realtek Semiconductor Corp. Bluetooth 5.3
Radio
Bus 001 Device 003: ID 10c4:ea60 Silicon Labs CP210x UART Bridge
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Lsusb-t:
/: Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
|__ Port 001: Dev 002, If 0, Class=Wireless, Driver=btusb, 12M
|__ Port 001: Dev 002, If 1, Class=Wireless, Driver=btusb, 12M
|__ Port 010: Dev 003, If 0, Class=Vendor Specific Class, Driver=cp210x,
12M
/: Bus 002.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/10p, 5000M
MachineType: MSI MS-7971
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
XDG_RUNTIME_DIR=<set>
ProcFB:
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-31-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro intel_iommu=on iommu=pt
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
SourcePackage: linux
UpgradeStatus: Upgraded to resolute on 2026-09-10 (3 days ago)
acpidump: Error: command ['pkexec', '/usr/share/apport/dump_acpi_tables.py']
failed with exit code 127: Error creating textual authentication agent: Error
opening current controlling terminal for the process (`/dev/tty'): No such
device or address
dmi.bios.date: 07/10/2018
dmi.bios.release: 5.12
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 1.K0
dmi.board.asset.tag: Default string
dmi.board.name: Z170-A PRO (MS-7971)
dmi.board.vendor: MSI
dmi.board.version: 1.0
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 3
dmi.chassis.vendor: MSI
dmi.chassis.version: 1.0
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvr1.K0:bd07/10/2018:br5.12:svnMSI:pnMS-7971:pvr1.0:rvnMSI:rnZ170-APRO(MS-7971):rvr1.0:cvnMSI:ct3:cvr1.0:skuDefaultstring:pfaDefaultstring:
dmi.product.family: Default string
dmi.product.name: MS-7971
dmi.product.sku: Default string
dmi.product.version: 1.0
dmi.sys.vendor: MSI
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute
** Attachment added: "dmesg.log — full kernel log of the affected boot
(7.0.0-31-generic), reconstructed from persistent journal; contains the
complete reset storm"
https://bugs.launchpad.net/bugs/2167211/+attachment/6000020/+files/dmesg.log
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167211
Title:
Regression in 7.0.0-31: RTL8761BU btusb enters permanent 30s USB reset
storm after single URB failure (self-recovered on 6.8.0-13x)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167211/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
