CVE-2022-49494: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49494 affects the Linux kernel's MTD (Memory Technology Device) NAND flash driver, specifically the Cadence NAND controller component. The vulnerability was discovered in 2022 and involves a potential null pointer dereference in the cadence_nand_dt_probe() function (Kernel Commit).

The vulnerability exists in the cadence_nand_dt_probe() function where a null pointer dereference could occur when using the 'res' variable if platform_get_resource() returns NULL. The issue stems from accessing res->start before properly validating the resource mapping. The fix involves reordering operations to ensure proper validation through devm_platform_get_and_ioremap_resource() and simplifying the code structure (Kernel Commit).

If exploited, this vulnerability could lead to a kernel crash due to the null pointer dereference, potentially causing a denial of service condition on affected systems running the vulnerable Linux kernel versions with the Cadence NAND controller driver (Kernel Commit).

The vulnerability requires local access to a system with the affected Cadence NAND controller driver. It can be triggered through normal driver operations when the hardware resource mapping fails (Kernel Commit).

The issue has been fixed by modifying the code to use devm_platform_get_and_ioremap_resource() and properly ordering the resource validation checks. Users should update to a patched kernel version that includes the fix (Kernel Commit).