CVE-2026-74738

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> regmap: sdw-mbq: don&amp;#39;t call an unset readable_reg callback<br /> <br /> regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit<br /> by calling ctx-&gt;readable_reg(), which is a straight copy of<br /> config-&gt;readable_reg. That callback is optional: regmap_readable() treats<br /> a NULL -&gt;readable_reg as "every register is readable", and drivers rely on<br /> that. es9356 and tac5xx2-sdw both build an MBQ regmap without one.<br /> <br /> Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable<br /> controls") the poll runs on every -ENODATA, not only for Controls the<br /> driver marked deferrable, so any of those devices answering<br /> COMMAND_IGNORED takes the kernel through a NULL function pointer.<br /> <br /> Treat a missing callback the way the rest of regmap does and poll.