Dear Maintainer,
*** Reporter, please consider answering these questions, where appropriate ***
* What led up to the situation?
After upgrading from linux-image-6.12.85+deb13-amd64 to
linux-image-6.12.85+deb13-amd64 for fix of CVE-2026-31431, and
to linux-image-6.12.88+deb13-amd64 for fix of later CVE(s), my
ThinkPad T16 AMD 2023 frequently goes black after resuming from
suspend state. The problem can be reproduced when I was running
linux-image-6.12.85+deb13-amd64 or linux-image-6.12.88+deb13-amd64.
Call Trace from journalctl --dmesg that keep appearing during the
problematic period:
<TASK>
__schedule+0x505/0xc00
schedule+0x27/0xf0
schedule_timeout+0x12f/0x160
wait_for_completion+0x8a/0x160
__flush_work+0x269/0x350
? __pfx_wq_barrier_func+0x10/0x10
__lru_add_drain_all+0x143/0x1e0
khugepaged+0x65/0x940
? __pfx_autoremove_wake_function+0x10/0x10
? __pfx_khugepaged+0x10/0x10
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
I can provide more kernel log if requested. I assume this is an
upstream issue, but up until current latest stable Debian kernel
as of 2026-05-20 the problem persist. Can't reproduce the issue
on 6.12.74+deb13.
* What exactly did you do (or not do) that was effective (or
ineffective)?
Suspend and then resume my laptop.
* What was the outcome of this action?
When the screen goes black, I can not use my laptop locally as
there is no feedback. Closing the laptop lid and opening it again
makes the screen go back to normal for a dozen of seconds and it
would went black again.
* What outcome did you expect instead?
Suspend and resuming would work normally.
To prevent affecting my daily usage, I have to reboot back into
linux-image-6.12.74+deb13+1-amd64 and keep using workarounds of
recent LPE CVEs.
I upgraded my Debian system today and at kernel version 6.12.90 the problem can still be reproduced. And then I decided to upgrade my laptop's firmware. After upgrading to `0.1.46` firmware the problem seemed to be disappear. Although the latest firmware version (as of 2026-05-25) is 0.1.49, I went through 0.1.45 -> 0.1.46 -> 0.1.47 -> 0.1.48 upgrade path and then stay at 0.1.48 for now. To work around previous upgrade failure I changed "Security -> UEFI BIOS Update Option -> Flash BIOS Updating by End-Users" to "On". Previously the "Secure RollBack Prevention" option in the same BIOS setting page was set to "Off" and I also changed it to "On". The way I upgraded my firmware: first find out the device UUID of the firmware by looking into: CLI> sudo fwupdmgr get-devices Then find out available firmware versions: CLI> sudo fwupdmgr get-releases 18cced7e-d108-41c4-9189-b0355c41450d Then applied the firmware upgrade (and went through 0.1.45 -> 0.1.46 -> 0.1.47 -> 0.1.48) CLI> sudo fwupdmgr install 18cced7e-d108-41c4-9189-b0355c41450d 0.1.46 Post the result here so that it may help other people.
New situation. Firmware 0.1.48 version and kernel 6.12.90 combination, I
encountered different call trace in the kernel log with similar symptom.
```
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 8 PID: 161145 at lib/refcount.c:28
refcount_warn_saturate+0xbe/0x110
Modules linked in: sd_mod scsi_mod scsi_common snd_seq_dummy snd_hrtimer
snd_seq snd_seq_device ccm michael_mic rfcomm cmac qrtr_mhi algif_h>
cryptd videobuf2_common snd_acp_legacy_common think_lmi snd_ctl_led rapl
ecdh_generic mc firmware_attributes_class wmi_bmof snd_hda_core sn>
usb_common button fan wmi
CPU: 8 UID: 0 PID: 161145 Comm: kworker/8:2 Not tainted 6.12.90+deb13-amd64
#1 Debian 6.12.90-1
Hardware name: LENOVO 21K7SIT018/21K7SIT018, BIOS R2FET68W (1.48 )
01/28/2026
Workqueue: pm pm_runtime_work
RIP: 0010:refcount_warn_saturate+0xbe/0x110
Code: 01 01 e8 e5 67 a2 ff 0f 0b e9 49 7d 86 00 80 3d 14 f0 78 01 00 75 85
48 c7 c7 60 55 39 8f c6 05 04 f0 78 01 01 e8 c2 67 a2 ff <0f> 0b >
RSP: 0018:ffffcfac8039fac0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8cb24c6f5300 RCX: 0000000000000027
RDX: ffff8cb5ff021788 RSI: 0000000000000001 RDI: ffff8cb5ff021780
RBP: 0000000000000003 R08: 0000000000000000 R09: ffffcfac8039f940
R10: ffffffff8fab43e8 R11: 0000000000000003 R12: 0000000000000010
R13: 00000000ffffff92 R14: ffffcfac8039faf4 R15: ffff8cb24c6f5300
FS: 0000000000000000(0000) GS:ffff8cb5ff000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f34316d4000 CR3: 0000000271622000 CR4: 0000000000f50ef0
PKRU: 55555554
<TASK>
tb_cfg_request_put+0x5a/0x70 [thunderbolt]
tb_cfg_write_raw+0x1de/0x280 [thunderbolt]
tb_cfg_write+0x59/0xf0 [thunderbolt]
usb4_switch_set_wake+0x278/0x3d0 [thunderbolt]
tb_switch_suspend+0xdf/0x190 [thunderbolt]
tb_runtime_suspend+0x4b/0x70 [thunderbolt]
tb_domain_runtime_suspend+0x1f/0x40 [thunderbolt]
nhi_runtime_suspend+0x1e/0x50 [thunderbolt]
pci_pm_runtime_suspend+0x67/0x1a0
? __pfx_pci_pm_runtime_suspend+0x10/0x10
__rpm_callback+0x41/0x170
? __pfx_pci_pm_runtime_suspend+0x10/0x10
rpm_callback+0x55/0x60
? __pfx_pci_pm_runtime_suspend+0x10/0x10
rpm_suspend+0xe6/0x5f0
? finish_task_switch.isra.0+0x97/0x2c0
pm_runtime_work+0x98/0xb0
process_one_work+0x174/0x330
worker_thread+0x191/0x2f0
? __pfx_worker_thread+0x10/0x10
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
---[ end trace 0000000000000000 ]---
INFO: task gmain:206789 blocked for more than 120 seconds.
Tainted: G W 6.12.90+deb13-amd64 #1 Debian 6.12.90-1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:gmain state:D stack:0 pid:206789 tgid:206787 ppid:1
flags:0x00004002
Call Trace:
<TASK>
__schedule+0x505/0xc00
schedule+0x27/0xf0
schedule_timeout+0x12f/0x160
wait_for_completion+0x8a/0x160
__flush_work+0x269/0x350
? __pfx_wq_barrier_func+0x10/0x10
fsnotify_destroy_group+0x58/0x110
? task_work_run+0x59/0x90
inotify_release+0x18/0x50
__fput+0xde/0x2a0
task_work_run+0x59/0x90
do_exit+0x330/0xad0
do_group_exit+0x30/0x80
get_signal+0x87c/0x880
arch_do_signal_or_restart+0x3f/0x250
syscall_exit_to_user_mode+0x139/0x1b0
do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? eventfd_read+0xdf/0x230
? srso_alias_return_thunk+0x5/0xfbef5
? vfs_read+0x244/0x360
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
? srso_alias_return_thunk+0x5/0xfbef5
? syscall_exit_to_user_mode+0x37/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? syscall_exit_to_user_mode+0x37/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
? srso_alias_return_thunk+0x5/0xfbef5
? syscall_exit_to_user_mode+0x37/0x1b0
? srso_alias_return_thunk+0x5/0xfbef5
? do_syscall_64+0x93/0x1b0
? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fe96285d9ee
RSP: 002b:00007fe961c6cb78 EFLAGS: 00000246 ORIG_RAX: 000000000000010f
RAX: fffffffffffffdfe RBX: 00007fe961c6d6c0 RCX: 00007fe96285d9ee
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00007fe95c000b70
RBP: 000000007fffffff R08: 0000000000000008 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000002 R14: 00007fe95c000b70 R15: 0000000000000002
</TASK>
INFO: task kworker/u48:39:209431 blocked for more than 120 seconds.
Tainted: G W 6.12.90+deb13-amd64 #1 Debian 6.12.90-1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u48:39 state:D stack:0 pid:209431 tgid:209431 ppid:2
flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
<TASK>
__schedule+0x505/0xc00
schedule+0x27/0xf0
schedule_timeout+0x12f/0x160
wait_for_completion+0x8a/0x160
__synchronize_srcu+0x8e/0xc0
? __pfx_wakeme_after_rcu+0x10/0x10
? synchronize_srcu+0xc0/0xe0
fsnotify_mark_destroy_workfn+0x8c/0x130
process_one_work+0x174/0x330
worker_thread+0x191/0x2f0
? __pfx_worker_thread+0x10/0x10
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
.
PM: suspend entry (s2idle)
Filesystems sync: 0.020 seconds
Freezing user space processes
Freezing user space processes completed (elapsed 0.002 seconds)
OOM killer disabled.
Freezing remaining freezable tasks
Freezing remaining freezable tasks failed after 20.008 seconds (0 tasks
refusing to freeze, wq_busy=1):
Showing freezable workqueues that are still busy:
workqueue events_freezable: flags=0x4
pwq 22: cpus=5 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: pci_pme_list_scan
workqueue pm: flags=0x4
pwq 30: cpus=7 node=0 flags=0x0 nice=0 active=0 refcnt=2
inactive: pm_runtime_work
workqueue btrfs-endio-write: flags=0xe
pwq 48: cpus=0-11 flags=0x4 nice=0 active=0 refcnt=34
inactive: 33*btrfs_work_helper [btrfs]
pwq 48: cpus=0-11 flags=0x4 nice=0 active=0 refcnt=17
inactive: 16*btrfs_work_helper [btrfs]
Restarting kernel threads ... done.
OOM killer enabled.
Restarting tasks ... done.
```
The following 3 lines appeared multiple times in the kernel log:
```
Freezing remaining freezable tasks
Freezing remaining freezable tasks failed after 20.005 seconds (0 tasks
refusing to freeze, wq_busy=1):
Showing freezable workqueues that are still busy:
```
But this time by plugging/unplugging the USB-C power supply cable, the
screen would light up for around 20 seconds and I was able to interact with
the system, then the screen would go black again. This trick might also
work when I first encountered the problem but I had not tried that.
With that I was able to reboot back into 6.12.88 kernel version and since
then (2026-05-26 09:42:01 UTC+8) I went through a few suspend/resume and no
call trace in kernel log so far.
丰 <...@gmail.com> 于2026年5月26日周二 17:58写道： So cursed. Firmware 0.1.48 and kernel 6.12.88 version. The initial problem appeared again, only that it took longer to reproduce. 333 Let me try attaching a log file from by last boot, to see how does it work out. Now I go back to 6.12.74 again p_q