CVE-2022-50106: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50106 is a vulnerability discovered in the Linux kernel, specifically affecting the powerpc/cell/axonmsi subsystem. The vulnerability was disclosed on June 18, 2025, and involves a refcount leak in the setupmsimsgaddress function (NVD).

The vulnerability occurs when ofgetnextparent() returns a node pointer with an incremented reference count, but the code fails to properly release the reference count in the error path. Specifically, the missing ofnode_put() call in the error path leads to a reference count leak (NVD, Wiz).

The vulnerability results in a reference count leak in the kernel's memory management system. While this may not lead to immediate system compromise, it could potentially cause resource exhaustion over time if triggered repeatedly (Wiz).

The vulnerability has been resolved by adding the missing ofnodeput() call in the error path to properly handle the reference count cleanup. Various Linux distributions have released patches to address this issue, including Ubuntu which has fixed this in multiple kernel versions including 5.4.0-132.148 for focal and 4.15.0-197.208 for bionic (Ubuntu).