CVE-2026-74738

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

regmap: sdw-mbq: don't call an unset readable_reg callback

regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit

by calling ctx->readable_reg(), which is a straight copy of

config->readable_reg. That callback is optional: regmap_readable() treats

a NULL ->readable_reg as "every register is readable", and drivers rely on

that. es9356 and tac5xx2-sdw both build an MBQ regmap without one.

Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable

controls") the poll runs on every -ENODATA, not only for Controls the

driver marked deferrable, so any of those devices answering

COMMAND_IGNORED takes the kernel through a NULL function pointer.

Treat a missing callback the way the rest of regmap does and poll.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References