Public bug reported:
Summary
-------
Since upgrading from 7.0.0-34 to 7.0.0-38 (and still on 7.0.0-42), the
laptop hard-locks every few days during normal desktop use. The kernel
log shows repeated i915 "PLANE ATS fault" errors on pipe A / plane 1A
(internal panel). Today's crash was captured in EFI pstore: a burst of
these faults was followed by "BUG: IRQ stack guard page was hit", a
NULL pointer dereference in the timer interrupt, and
"Kernel panic - not syncing: Fatal exception in interrupt". kdump is
loaded but crashed too (NULL deref in machine_crash_shutdown), so the
machine hangs instead of rebooting and needs a hard power-off.
System
------
- Ubuntu 26.04.1 LTS
- Kernel: 7.0.0-42-generic #42-Ubuntu (package 7.0.0-42.42), not tainted
- Hardware: Lenovo ThinkPad E16 Gen 3 (21SR0041GE)
- BIOS: R30ET55W (1.55), 01/07/2026 (fwupd reports no newer firmware)
- CPU: Intel Core Ultra 7 255H
- GPU: Intel Arrow Lake-P [8086:7dd1] rev 03, driven by i915
(xe is also loaded but not bound)
- GuC firmware: i915/mtl_guc_70.bin 70.53.0, HuC: i915/mtl_huc_gsc.bin 8.5.4
- IOMMU enabled (dmar0, dmar1), default kernel command line:
quiet splash crashkernel=...
- Desktop: GNOME on Wayland
Regression range
----------------
- 7.0.0-31: 5 boots over ~4 weeks, no unexpected hangs
- 7.0.0-34: 1 boot, 7 days uptime, no unexpected hangs
- 7.0.0-38: about 6 hangs between 2026-10-05 and 2026-10-14 that
needed a hard power-off
- 7.0.0-42: kernel panic on 2026-11-02 (captured below)
On 7.0.0-38 the end of the kernel log never reached disk, so those hangs
have no trace. The 2026-10-14 boot on 7.0.0-38 logged the same
"PLANE ATS fault" on pipe A / plane 1A earlier in the session.
Crash trace (from /var/lib/systemd/pstore, 7.0.0-42, uptime ~73 h)
-----------------------------------------------------------------
About 66 minutes before the panic, a first burst of faults:
i915 0000:00:02.0: [drm] *ERROR* [CRTC:150:pipe A] PLANE ATS fault
i915 0000:00:02.0: [drm] *ERROR* [CRTC:150:pipe A][PLANE:34:plane 1A] fault
(CTL=0x82009400, SURF=0x1fe5000, SURFLIVE=0x1fe5000)
(repeated many times)
At the panic:
[263135.151903] i915 0000:00:02.0: [drm] *ERROR* [CRTC:150:pipe A] PLANE ATS
fault
[263135.151930] BUG: kernel NULL pointer dereference, address:
0000000000000007
[263135.151935] handle_plane_fault: 1 callbacks suppressed
[263135.151941] i915 0000:00:02.0: [drm] *ERROR* [CRTC:150:pipe
A][PLANE:34:plane 1A] fault (CTL=0x82009400, SURF=0x1fe9000, SURFLIVE=0x1fe9000)
[263135.151966] #PF: supervisor write access in kernel mode
[263135.151972] #PF: error_code(0x0002) - not-present page
[263135.151984] Oops: Oops: 0002 [#1] SMP NOPTI
[263135.151993] CPU: 9 UID: 1001 PID: 68587 Comm: firefox.real Kdump: loaded
Not tainted 7.0.0-42-generic #42-Ubuntu PREEMPT(lazy)
[263135.152001] Hardware name: LENOVO 21SR0041GE/21SR0041GE, BIOS
R30ET55W(1.55 ) 01/07/2026
[263135.152005] RIP: 0010:__raise_softirq_irqoff+0x0/0xa0
[263135.152056] Call Trace:
[263135.152061] <IRQ>
[263135.152063] ? raise_softirq+0x24/0x70
[263135.152074] sched_balance_trigger+0x66/0x90
[263135.152082] sched_tick+0xe1/0x270
[263135.152106] update_process_times+0x90/0xd0
[263135.152112] tick_nohz_handler+0x96/0x1a0
[263135.152117] __hrtimer_run_queues+0x10c/0x270
[263135.152122] hrtimer_interrupt+0x104/0x250
[263135.152128] __sysvec_apic_timer_interrupt+0x58/0x150
[263135.152137] sysvec_apic_timer_interrupt+0x9a/0xd0
[263135.152139] </IRQ>
[263135.152149] RIP: 0010:smp_call_function_many_cond+0x120/0x5e0
[263135.152198] native_flush_tlb_multi+0x68/0x180
[263135.152209] flush_tlb_mm_range+0x173/0x390
[263135.152233] vms_complete_munmap_vmas+0x1f7/0x280
[263135.152255] __x64_sys_munmap+0x1b/0x30
[263135.152283] BUG: IRQ stack guard page was hit at ffffd09240524ff8 (stack
is ffffd09240525000..ffffd09240529000)
[263135.152682] BUG: kernel NULL pointer dereference, address:
0000000000000000
[263135.152696] Oops: Oops: 0002 [#2] SMP NOPTI
[263135.152708] RIP: 0010:machine_crash_shutdown+0x2/0x20
[263135.949839] Kernel panic - not syncing: Fatal exception in interrupt
[263137.090472] Shutting down cpus with NMI
The firefox process is only the task that was running when the timer
interrupt hit. The trigger seems to be the display fault interrupts
overflowing the IRQ stack.
After the reboot, the current boot logs this on the same pipe:
i915 0000:00:02.0: [drm] *ERROR* [CRTC:150:pipe A] DSB 0 poll error
Steps to reproduce
------------------
No reliable reproducer. It happens during normal desktop use (Firefox,
LibreOffice, VS Code on GNOME Wayland, internal panel only) after hours
to days of uptime, every few days.
Expected: no display faults and no hangs, as on 7.0.0-34.
Actual: PLANE ATS faults on pipe A, then a hard lock or panic.
Attachments
-----------
- pstore-panic-dmesg.txt: the full EFI pstore records of the 7.0.0-42
panic (Oops#1 and Panic#2)
Workaround being tested
-----------------------
intel_iommu=igfx_off on the kernel command line. I will report back
whether it prevents the faults and hangs.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-42-generic 7.0.0-42.42
ProcVersionSignature: Ubuntu 7.0.0-42.42-generic 7.0.14
Uname: Linux 7.0.0-42-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: daniel 4145 F.... pipewire
daniel 4149 F.... wireplumber
/dev/snd/seq: daniel 4145 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Mon Nov 2 10:56:37 2026
MachineType: LENOVO 21SR0041GE
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-42-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
WifiSyslog:
dmi.bios.date: 01/07/2026
dmi.bios.release: 1.55
dmi.bios.vendor: LENOVO
dmi.bios.version: R30ET55W(1.55 )
dmi.board.asset.tag: Not Available
dmi.board.name: 21SR0041GE
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T76530 WIN
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.55
dmi.modalias:
dmi:bvnLENOVO:bvrR30ET55W(1.55):bd01/07/2026:br1.55:efr1.55:svnLENOVO:pn21SR0041GE:pvrThinkPadE16Gen3:rvnLENOVO:rn21SR0041GE:rvrSDK0T76530WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21SR_BU_Think_FM_ThinkPadE16Gen3:pfaThinkPadE16Gen3:
dmi.product.family: ThinkPad E16 Gen 3
dmi.product.name: 21SR0041GE
dmi.product.sku: LENOVO_MT_21SR_BU_Think_FM_ThinkPad E16 Gen 3
dmi.product.version: ThinkPad E16 Gen 3
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
** Attachment added: "the full record the kernel saved when it crashed"
https://bugs.launchpad.net/bugs/2172743/+attachment/6014264/+files/pstore-panic-dmesg.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172743
Title:
i915: PLANE ATS fault storm on Arrow Lake-P [8086:7dd1] leads to IRQ
stack overflow and kernel panic (regression since 7.0.0-38)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172743/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
