CVE-2026-74738 Overview
CVE-2026-74738 is a NULL pointer dereference in the Linux kernel's regmap subsystem, specifically the SoundWire Multi-Byte Quantity (sdw-mbq) helper. The function regmap_sdw_mbq_poll_busy() invokes ctx->readable_reg() without verifying that the callback was registered by the driver. The readable_reg callback is optional, and drivers such as es9356 and tac5xx2-sdw build MBQ regmaps without providing one. When these devices respond with COMMAND_IGNORED, the poll path dereferences a NULL function pointer and crashes the kernel.
Critical Impact
A missing optional callback triggers a NULL function pointer call in kernel context, producing a kernel oops or panic that can render the affected system unavailable.
Affected Products
- Linux kernel builds containing commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls")
- Systems using SoundWire MBQ regmaps without a readable_reg callback (for example, es9356 and tac5xx2-sdw codec drivers)
- Stable kernel branches that backported the ca1b11b36d82 change
Discovery Timeline
- 2026-08-26 - CVE-2026-74738 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74738
Vulnerability Analysis
The defect lives in regmap_sdw_mbq_poll_busy(), which decides whether to poll the SoundWire Function Busy bit by asking whether a register is readable. It does this by calling ctx->readable_reg(), a direct copy of config->readable_reg supplied by the driver. Elsewhere in regmap, a NULL ->readable_reg is treated as "every register is readable" by regmap_readable(), and drivers depend on that convention.
Before commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls"), the poll path only ran for controls explicitly marked deferrable. After that change, the poll runs on every -ENODATA return, including responses of COMMAND_IGNORED from SoundWire peripherals. Drivers that omit readable_reg therefore route the kernel through a NULL function pointer during normal bus activity.
Root Cause
The root cause is an inconsistent contract inside regmap. The core treats an unset readable_reg as permissive, but the sdw-mbq helper assumes the callback is always present. This is a NULL pointer dereference [CWE-476] triggered by an unchecked optional callback in kernel code.
Attack Vector
The condition is reachable through the SoundWire bus. A peripheral that returns COMMAND_IGNORED for an MBQ transaction to a regmap without a readable_reg callback causes the poll to fire on -ENODATA and dereference NULL. The fault requires the vulnerable driver combination to be loaded and interacting with a responsive SoundWire device.
No verified exploitation code is available. Technical details are documented in the upstream fixes: Kernel Git Commit 00268f94, Kernel Git Commit 5bd8e897, and Kernel Git Commit 6cf600b2.
Detection Methods for CVE-2026-74738
Indicators of Compromise
- Kernel oops or panic reports whose call stack includes regmap_sdw_mbq_poll_busy and a NULL instruction pointer.
- Log entries showing COMMAND_IGNORED responses on the SoundWire bus immediately before the fault.
- Recurring crashes on systems running the es9356 or tac5xx2-sdw codec drivers after a kernel update that included commit ca1b11b36d82.
Detection Strategies
- Inventory running kernels and confirm whether commit ca1b11b36d82 is present without one of the three fix commits listed in the references.
- Correlate audio subsystem crashes with SoundWire codec drivers that build MBQ regmaps without a readable_reg callback.
- Review dmesg and persistent crash logs for repeated NULL pointer dereferences in the regmap call path.
Monitoring Recommendations
- Forward kernel crash telemetry and kdump output to a central log store for pattern analysis across fleets.
- Track kernel package versions on Linux endpoints and servers, alerting when hosts run vulnerable stable branches.
- Monitor audio and codec driver load events on systems that use SoundWire hardware, since the fault triggers only when those drivers are active.
How to Mitigate CVE-2026-74738
Immediate Actions Required
- Apply the upstream fixes referenced by commits 00268f94, 5bd8e897, and 6cf600b2 to affected kernel trees.
- Update to stable kernel releases that include the fix once distributions publish them.
- Identify hosts running the es9356 or tac5xx2-sdw drivers and prioritize them for patching.
Patch Information
The fix teaches regmap_sdw_mbq_poll_busy() to treat a missing readable_reg callback the same way the rest of regmap does: assume the register is readable and poll. The change is available in three commits linked from NVD: Kernel Git Commit 00268f94, Kernel Git Commit 5bd8e897, and Kernel Git Commit 6cf600b2.
Workarounds
- Unload or blacklist the affected SoundWire codec drivers on systems where audio functionality is not required until a patched kernel is deployed.
- Revert commit ca1b11b36d82 on locally built kernels if the upstream fix cannot yet be applied, restoring the prior narrower poll behavior.
- Avoid enabling deferred control paths on hardware known to answer COMMAND_IGNORED when running an unpatched kernel.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
