CVE-2022-50105: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50105 is a reference count leak vulnerability discovered in the Linux kernel's powerpc/spufs subsystem, specifically in the spufs_init_isolated_loader function. The issue was identified and disclosed on June 18, 2025. The vulnerability occurs when of_find_node_by_path() returns a remote device node pointer with an incremented reference count, but the code fails to properly release this reference count using of_node_put() when the operation is complete (NVD, Wiz).

The vulnerability stems from a missing of_node_put() call in the spufs_init_isolated_loader function. When of_find_node_by_path() is called, it returns a remote device node pointer with an incremented reference count. However, the code does not properly decrement this reference count when the operation is complete, leading to a reference count leak (Wiz).

A reference count leak in the kernel can lead to memory resource exhaustion over time, potentially affecting system stability and performance. This type of vulnerability could result in system resource depletion if exploited repeatedly (Wiz).

The vulnerability has been fixed by adding the missing of_node_put() call to properly release the reference count when the node pointer is no longer needed. Users should update their Linux kernel to a version that includes this fix (Wiz).