Vulnerability Database

309,540

Total vulnerabilities in the database

CVE-2022-49805

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init()

lan966x_stats_init() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may happen:

lan966x_stats_init() create_singlethread_workqueue() # failed, lan966x->stats_queue is NULL queue_delayed_work() queue_delayed_work_on() __queue_delayed_work() # warning here, but continue __queue_work() # access wq->flags, null-ptr-deref

Check the ret value and return -ENOMEM if it is NULL.

  • Published: May 1, 2025
  • Updated: Nov 8, 2025
  • CVE: CVE-2022-49805
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.5
  • AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWEs:

Software From Fixed in
linux / linux_kernel 5.17 6.0.10
linux / linux_kernel 6.1-rc1 6.1-rc1.x
linux / linux_kernel 6.1-rc2 6.1-rc2.x
linux / linux_kernel 6.1-rc3 6.1-rc3.x
linux / linux_kernel 6.1-rc4 6.1-rc4.x
linux / linux_kernel 6.1-rc5 6.1-rc5.x