CVE-2022-49806: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49806 is a vulnerability in the Linux kernel affecting the Microchip Sparx5 network driver. The vulnerability was discovered and disclosed on May 1, 2025, specifically impacting the sparx_stats_init() and sparx5_start() functions (NVD, Ubuntu Security).

The vulnerability occurs when sparx_stats_init() calls create_singlethread_workqueue() without checking the return value. This can lead to a null pointer dereference in the following sequence: when queue_delayed_work() is called, it leads to queue_delayed_work_on() and __queue_delayed_work(), ultimately resulting in a null pointer dereference when attempting to access wq->flags (Wiz, Red Hat).

If exploited, this vulnerability could lead to a system crash due to the null pointer dereference, potentially causing a denial of service condition in affected systems running the Microchip Sparx5 network driver (Wiz).

The vulnerability has been patched by adding proper return value checking for create_singlethread_workqueue() and returning -ENOMEM if it is NULL. Fixed versions are available in Ubuntu 22.04 LTS (5.15.0-67.74), Ubuntu 20.04 LTS (5.15.0-67.74~20.04.1), and other affected distributions (Ubuntu Security).