CVE-2026-74738 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
regmap: sdw-mbq: don't call an unset readable_reg callback
regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit by calling ctx->readable_reg(), which is a straight copy of config->readable_reg. That callback is optional: regmap_readable() treats a NULL ->readable_reg as "every register is readable", and drivers rely on that. es9356 and tac5xx2-sdw both build an MBQ regmap without one.
Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls") the poll runs on every -ENODATA, not only for Controls the driver marked deferrable, so any of those devices answering COMMAND_IGNORED takes the kernel through a NULL function pointer.
Treat a missing callback the way the rest of regmap does and poll.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's register map subsystem contains a critical flaw within the soundwire multi-buffer queue implementation that leads to a null pointer dereference when interacting with specific audio codec drivers. This vulnerability arises from an inconsistency in how optional callback functions are handled during hardware polling operations. Specifically, the function regmap_sdw_mbq_poll_busy is responsible for determining whether to poll the Function Busy bit of a device by invoking the ctx->readable_reg callback. This callback serves as a mechanism to identify which registers can be read without causing side effects or errors. However, this implementation fails to account for scenarios where the readable_reg pointer is null, despite the broader regmap framework explicitly supporting such cases by treating a NULL readable_reg as an indication that every register is readable and safe to access.
The root cause of this issue stems from changes introduced in commit ca1b11b36d82, which modified the behavior of the polling mechanism to run on every -ENODATA return value rather than limiting it only to controls explicitly marked as deferrable by the driver. This expansion of scope inadvertently exposed a latent defect where drivers that do not provide a readable_reg callback would trigger a null pointer dereference if their hardware responded with COMMAND_IGNORED during a polling attempt. Devices such as the es9356 and tac5xx2-sdw audio codecs build an MBQ regmap configuration without defining this optional callback, relying on the default behavior of the subsystem. When these devices encounter conditions that result in -ENODATA followed by a COMMAND_IGNORED response, the kernel attempts to execute a function pointer that is not initialized, leading to a crash or system instability.
From a technical perspective, this vulnerability represents a classic null pointer dereference resulting from improper validation of optional interface pointers before invocation. The flaw violates the principle of defensive programming where software should gracefully handle missing configurations by falling back to safe defaults rather than assuming all required callbacks are present. In the context of industry standards, this aligns with CWE-476, which describes a NULL pointer dereference vulnerability that occurs when an application attempts to use a null pointer instead of providing for the existence of such pointers. Furthermore, while not directly exploitable by external attackers in most typical deployments due to its nature as a local kernel crash triggered by specific hardware interactions, it impacts system availability and reliability, which are core components of security posture under frameworks like ATT&CK that consider denial-of-service vectors against infrastructure services.
The operational impact of this vulnerability includes potential kernel panics or unexpected reboots when the affected audio codecs are in use, particularly during dynamic power management states or error recovery sequences where COMMAND_IGNORED responses might be generated. For systems relying on these specific soundwire devices for critical audio processing functions, such instability can lead to service interruptions and loss of data integrity if processes are abruptly terminated. Although this is primarily a stability issue rather than a direct privilege escalation vector, the resulting denial of service affects the availability aspect of the CIA triad and could be leveraged in localized scenarios where an attacker might induce specific hardware states to trigger the crash repeatedly.
To mitigate this vulnerability, developers must ensure that any code path invoking optional regmap callbacks performs explicit null checks before execution. The fix involves modifying the regmap_sdw_mbq_poll_busy function to treat a missing readable_reg callback identically to how other parts of the regmap subsystem handle it: by assuming all registers are readable and proceeding with the polling operation without attempting to validate register accessibility through a non-existent pointer. This aligns the behavior with the established contract of the API where NULL implies universal readability. System administrators should apply kernel updates that include this patch as soon as they become available for their respective distributions, ensuring that the regmap subsystem correctly handles optional callbacks across all supported hardware configurations. Regular auditing of driver code to verify proper handling of optional function pointers can prevent similar issues in other subsystems and maintain overall system robustness against internal logic errors.