CVE-2022-49806

Source
https://cve.org/CVERecord?id=CVE-2022-49806
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49806.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49806
Downstream
Published
2025-05-01T14:09:32.854Z
Modified
2026-03-20T11:47:16.160223Z
Summary
net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start()
Details

In the Linux kernel, the following vulnerability has been resolved:

net: microchip: sparx5: Fix potential null-ptr-deref in sparxstatsinit() and sparx5_start()

sparxstatsinit() calls createsinglethreadworkqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may happen:

sparxstatsinit() createsinglethreadworkqueue() # failed, sparx5->statsqueue is NULL queuedelayedwork() queuedelayedworkon() __queuedelayedwork() # warning here, but continue _queuework() # access wq->flags, null-ptr-deref

Check the ret value and return -ENOMEM if it is NULL. So as sparx5_start().

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49806.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2
Fixed
80e590aeb132887102c3fa79d99b338f099dc952
Fixed
456327e565dc49d18b2f595f39f47df8a36f1057
Fixed
639f5d006e36bb303f525d9479448c412b720c39

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49806.json"