CVE-2026-74738: regmap: sdw-mbq: don't call an unset readable_reg callback
In the Linux kernel, the following vulnerability has been resolved:
regmap: sdw-mbq: don't call an unset readablereg callback
regmapsdwmbqpollbusy() decides whether to poll the Function Busy bit by calling ctx->readablereg(), which is a straight copy of config->readablereg. That callback is optional: regmapreadable() treats a NULL ->readablereg as "every register is readable", and drivers rely on that. es9356 and tac5xx2-sdw both build an MBQ regmap without one.
Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls") the poll runs on every -ENODATA, not only for Controls the driver marked deferrable, so any of those devices answering COMMANDIGNORED takes the kernel through a NULL function pointer.
Treat a missing callback the way the rest of regmap does and poll.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this crash path?
Systems using SoundWire MBQ regmaps without a readable_reg callback are exposed when the device returns COMMAND_IGNORED. The description specifically identifies es9356 and tac5xx2-sdw as drivers that build an MBQ regmap without this callback.
What conditions trigger the vulnerability?
The trigger is a -ENODATA response associated with COMMAND_IGNORED, which causes regmap_sdw_mbq_poll_busy() to invoke the optional readable_reg callback. If that callback was not configured, the kernel reaches a NULL function pointer call.
Are configurations without a readable_reg callback affected?
Yes. A missing readable_reg callback is a supported configuration and normally means every register is considered readable. The vulnerable polling path did not handle that default behavior before the fix.