CVE-2022-50634: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50634 is a null pointer dereference vulnerability in the Linux kernel's power supply subsystem, specifically in the CW2015 battery fuel gauge driver (cw2015). The flaw exists in the cw_bat_probe() function, which calls create_singlethread_workqueue() without checking the return value; if the call fails and returns NULL, a subsequent call to queue_delayed_work() will dereference the null pointer, potentially causing a kernel crash. The vulnerability was published on December 9, 2025, and affects Linux kernel versions starting from the introduction of the cw2015 driver (around v5.8) up to the commits that introduced the fix. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.017% (Feedly).

The root cause is classified as a NULL Pointer Dereference (CWE-476). In cw_bat_probe(), the kernel driver for the CW2015 battery gauge calls create_singlethread_workqueue() to create a work queue (cw_bat->wq), but does not validate the return value before passing it to queue_delayed_work(). If workqueue creation fails (e.g., due to memory pressure), cw_bat->wq remains NULL. The subsequent call chain — queue_delayed_work() → queue_delayed_work_on() → __queue_delayed_work() → __queue_work() — attempts to access wq->flags, triggering a null pointer dereference in kernel space. The fix adds a return value check and returns -ENOMEM if the workqueue creation fails (Feedly, Kernel Git).

Successful triggering of this vulnerability causes a kernel null pointer dereference, which typically results in a kernel panic (system crash), leading to a denial of service on the affected device. Because the flaw resides in a hardware driver for the CW2015 battery fuel gauge — a component found primarily in embedded Linux systems and mobile/IoT devices — the availability impact is the primary concern, with no direct confidentiality or integrity impact. Lateral movement or data exfiltration are not applicable in the typical exploitation scenario for this class of driver bug (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50634. The vulnerability requires local access to a system running an affected kernel with the CW2015 driver loaded, and exploitation would typically require triggering a low-memory condition during device probe. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation (Feedly). This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The Linux kernel maintainers have addressed this vulnerability by adding a null check on the return value of create_singlethread_workqueue() in cw_bat_probe(), returning -ENOMEM on failure. Fixes are available in stable kernel commits 97f2b4ddb0aa (for one stable branch), f7e2ba8ed081 (for another), and 5150b76aa2eb (for a third), corresponding to patched stable releases including 6.0.16, 6.1.2, and 6.2 (Feedly, Kernel Git). Users running affected embedded or mobile Linux systems should update to a kernel version containing these fixes. No configuration-based workaround is available; upgrading the kernel is the recommended remediation.