CVE-2022-49806: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49806 is a vulnerability in the Linux kernel affecting the Microchip Sparx5 network driver. The vulnerability was discovered and disclosed on May 1, 2025, specifically impacting the sparx_stats_init() and sparx5_start() functions (NVD, Ubuntu Security).

The vulnerability occurs when sparx_stats_init() calls create_singlethread_workqueue() without checking the return value. This can lead to a null pointer dereference in the following sequence: when queue_delayed_work() is called, it leads to queue_delayed_work_on() and __queue_delayed_work(), ultimately resulting in a null pointer dereference when attempting to access wq->flags (Wiz, Red Hat).

If exploited, this vulnerability could lead to a system crash due to the null pointer dereference, potentially causing a denial of service condition in affected systems running the Microchip Sparx5 network driver (Wiz).

The vulnerability has a CVSS v3.1 Base Score of 5.5, indicating moderate severity. The attack vector is Local, requiring local access to the system for exploitation (Red Hat).

The vulnerability has been patched by adding proper return value checking for create_singlethread_workqueue() and returning -ENOMEM if it is NULL. Fixed versions are available in Ubuntu 22.04 LTS (5.15.0-67.74), Ubuntu 20.04 LTS (5.15.0-67.74~20.04.1), and other affected distributions (Ubuntu Security).