CVE-2022-50105: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50105 is a reference count leak vulnerability in the Linux kernel's powerpc/spufs subsystem, specifically in the spufs_init_isolated_loader function. The flaw occurs because of_find_node_by_path() returns a device node pointer with an incremented reference count, but the code fails to call of_node_put() to release it when done. Affected kernel versions span from 2.6.20 up to (but not including) 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2 across multiple stable branches. The vulnerability was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a missing of_node_put() call in spufs_init_isolated_loader, classified as CWE-401 (Missing Release of Memory after Effective Lifetime) or more broadly as a resource management error. When of_find_node_by_path() is called, it increments the reference count of the returned device tree node; without a corresponding of_node_put(), the reference is never decremented, causing a slow reference count leak in the kernel's device tree subsystem. Exploitation requires local access with low privileges (no user interaction needed), and the vulnerability is constrained to PowerPC systems running the SPU filesystem (spufs), limiting its attack surface to hardware platforms with Cell Broadband Engine processors (Feedly).

The primary impact is on system availability: the reference count leak can lead to resource exhaustion over time, degrading memory management and system stability on affected PowerPC systems. There is no confidentiality or integrity impact, as the flaw does not expose sensitive data or allow unauthorized modification of system state. The vulnerability is locally scoped and does not enable lateral movement or remote exploitation (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-50105. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

Patches have been released for all affected stable kernel branches. Users should update to the following minimum versions: 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, or 5.19.2, depending on their current branch. Patch commits are available in the Linux stable kernel repository (Kernel Patches). As a secondary measure, restricting local system access to minimize the number of users who can interact with the spufs subsystem reduces exposure until patching is feasible.