CVE-2026-74738 - Vulnerability Details

- regmap: sdw-mbq: don't call an unset readable_reg callback

Description

In the Linux kernel, the following vulnerability has been resolved:

regmap: sdw-mbq: don't call an unset readable_reg callback

regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit
by calling ctx->readable_reg(), which is a straight copy of
config->readable_reg. That callback is optional: regmap_readable() treats
a NULL ->readable_reg as "every register is readable", and drivers rely on
that. es9356 and tac5xx2-sdw both build an MBQ regmap without one.

Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable
controls") the poll runs on every -ENODATA, not only for Controls the
driver marked deferrable, so any of those devices answering
COMMAND_IGNORED takes the kernel through a NULL function pointer.

Treat a missing callback the way the rest of regmap does and poll.

Published: 2026-08-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s regmap subsystem can invoke a readable_reg callback that is unset (NULL) during polling of the Function Busy bit. This leads to a null‑pointer dereference in regmap_sdw_mbq_poll_busy and causes a kernel crash. The crash results in a denial of service of the affected system. Affected drivers es9356 and tac5xx2-sdw build an MBQ regmap without this callback, making the issue visible in those configurations.

Affected Systems

Affected systems are Linux kernel builds that employ the sdwmbq regmap driver without a readable_reg callback, specifically those supporting es9356 or tac5xx2‑sdw. The vulnerability exists in any kernel version before the inclusion of commit ca1b11b36d82, which patches the issue.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity. Based on the description, it is inferred that the attack requires local device interaction, so the vector is local; there is no documented remote exploitation path. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Immediate updating is advised to mitigate the risk of kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5bc493bf0c37c157bf2eb364e55a1c6f8bc43a69`	affected	< 6cf600b276a55a6481462830607a611f32e737c0
`5bc493bf0c37c157bf2eb364e55a1c6f8bc43a69`	affected	< 5bd8e897ecf558507142f4553e4526adfc1d6482
`5bc493bf0c37c157bf2eb364e55a1c6f8bc43a69`	affected	< 00268f9452d2a0d660aa9c1bb0ca07a994af6a4f

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5bc493bf0c37c157bf2eb364e55a1c6f8bc43a69,6cf600b276a55a6481462830607a611f32e737c0)`	affected	code_commit	—
`[5bc493bf0c37c157bf2eb364e55a1c6f8bc43a69,5bd8e897ecf558507142f4553e4526adfc1d6482)`	affected	code_commit	—
`[5bc493bf0c37c157bf2eb364e55a1c6f8bc43a69,00268f9452d2a0d660aa9c1bb0ca07a994af6a4f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	semver	—
`[0,6.14)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to include commit ca1b11b36d82, which corrects the regmap_sdw_mbq_poll_busy logic and treats missing callbacks safely.
Rebuild the kernel and verify that the sdwmbq drivers for es9356 and tac5xx2-sdw use the updated regmap configuration with proper callback handling.
If a kernel update cannot be applied immediately, disable polling or restrict access to devices that use an unset readable_reg callback until remediation is complete.

Generated by OpenCVE AI on August 28, 2026 at 17:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00268f9452d2a0d660aa9c1bb0ca07a994af6a4f
https://git.kernel.org/stable/c/5bd8e897ecf558507142f4553e4526adfc1d6482
https://git.kernel.org/stable/c/6cf600b276a55a6481462830607a611f32e737c0
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74738-4552@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74738
https://www.cve.org/CVERecord?id=CVE-2026-74738

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74738-4552@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74738 https://www.cve.org/CVERecord?id=CVE-2026-74738
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 26 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readable_reg callback regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit by calling ctx->readable_reg(), which is a straight copy of config->readable_reg. That callback is optional: regmap_readable() treats a NULL ->readable_reg as "every register is readable", and drivers rely on that. es9356 and tac5xx2-sdw both build an MBQ regmap without one. Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls") the poll runs on every -ENODATA, not only for Controls the driver marked deferrable, so any of those devices answering COMMAND_IGNORED takes the kernel through a NULL function pointer. Treat a missing callback the way the rest of regmap does and poll.
Title		regmap: sdw-mbq: don't call an unset readable_reg callback
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00268f9452d2a0d660aa9c1bb0ca07a994af6a4f https://git.kernel.org/stable/c/5bd8e897ecf558507142f4553e4526adfc1d6482 https://git.kernel.org/stable/c/6cf600b276a55a6481462830607a611f32e737c0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:36:51.136Z

Updated: 2026-08-26T14:36:51.136Z

Reserved: 2026-08-15T05:44:03.930Z

Link: CVE-2026-74738

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:16:52.480

Modified: 2026-08-26T15:16:52.480

Link: CVE-2026-74738

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-74738 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T18:00:15Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object