CVE-2022-50415: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50415 is a NULL Pointer Dereference vulnerability in the Linux kernel's PA-RISC LED driver (parisc/led). The flaw exists in the start_task() function, which calls create_singlethread_workqueue() without checking the return value; if the call fails and returns NULL, subsequent workqueue operations dereference the NULL pointer, causing a kernel crash. Affected kernel versions span from 2.6.15 up to (excluding) 4.9.337, 4.10–4.14.303, 4.15–4.19.270, 4.20–5.4.229, 5.5–5.10.163, 5.11–5.15.87, 5.16–6.0.18, and 6.1–6.1.4. The CVE was published on September 18, 2025, with patches backported across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In start_task() within the PA-RISC LED subsystem, create_singlethread_workqueue() can return NULL under memory pressure or other failure conditions, but the return value was never validated. When queue_delayed_work() is subsequently called with the NULL led_wq pointer, the call chain proceeds through queue_delayed_work_on() → __queue_delayed_work() → __queue_work(), where wq->flags is accessed on the NULL pointer, triggering a kernel panic. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction. The fix adds a NULL check after create_singlethread_workqueue() and returns -ENOMEM if the workqueue creation fails (Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. There is no confidentiality or integrity impact — only availability is affected, as the crash brings down the entire system. The vulnerability is limited in scope to systems running PA-RISC (parisc) architecture Linux kernels with the LED driver active, which significantly constrains the affected population (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2022-50415. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges on a PA-RISC system, which is a rare hardware platform, further limiting practical exploitability (Feedly).

The Linux kernel project has released patches across all affected stable branches. Administrators should update to the following fixed versions or later: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, or 6.2+. Patches are available via the upstream kernel stable tree. As a workaround on systems where the PA-RISC LED driver is not required, the led module can be blacklisted to prevent the vulnerable code path from executing (Feedly, kernel.org patches).