This vulnerability occurs in the Linux kernel’s regmap subsystem when the sdwmbq driver invokes a readable_reg callback that is unset (NULL). The code incorrectly calls ctx->readable_reg(), which may point to a null function pointer, causing a kernel null‑pointer dereference during polling of the Function Busy bit. The resultant kernel crash allows a local attacker to potentially execute arbitrary code with elevated privileges or cause a denial of service by interrupting the kernel. Devices such as es9356 or tac5xx2‑sdw that build an MBQ regmap without providing this callback are particularly susceptible.

Affected systems are Linux kernel builds that employ the sdwmbq regmap driver without a readable_reg callback, specifically those supporting es9356 or tac5xx2‑sdw. The vulnerability exists in any kernel version before the inclusion of commit ca1b11b36d82, which patches the issue.

Although an official CVSS score is not listed, the null-pointer dereference represents high severity. The EPSS score is not available and the vulnerability is not cited in the CISA KEV catalog. Attack requires local device interaction, so the vector is inferred as local; there is no documented remote exploitation path. Immediate updating is advised to mitigate the high risk of kernel crash.