CVE-2022-50870: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50870 is a vulnerability in the Linux kernel's PowerPC RTAS (Run-Time Abstraction Services) subsystem, specifically in the rtas_os_term() function. The function is called during kernel panic and performs device tree lookups that involve locking (devtree_lock) and local IRQ state changes; if the kernel panics while devtree_lock is already held, the system can hang indefinitely. The vulnerability affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the fixes backported into stable releases including 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.17, 6.1.3, and 6.2. It was published on December 30, 2025, and carries an EPSS score of approximately 0.024% (Feedly, EUVD). No CVSS base score has been assigned by the Linux kernel assigner.

The root cause is a deadlock/hang condition (related to CWE-667: Improper Locking) in the rtas_os_term() function within arch/powerpc/kernel/rtas.c. During a kernel panic, this function traverses the /rtas device tree node to check properties such as ibm,extended-os-term, which requires acquiring devtree_lock and modifying local IRQ state. If the panic occurs while another code path already holds devtree_lock, rtas_os_term() will deadlock, preventing the panic handler from completing. The fix caches the relevant device tree properties in file-static variables at boot time, eliminating the need for any locking or IRQ manipulation during panic, and converts the ibm,extended-os-term lookup to of_property_read_bool() since it is a boolean property rather than an RTAS function token (Feedly, EUVD).

The primary impact of this vulnerability is an availability issue: a kernel panic on a PowerPC system running a vulnerable Linux kernel version may result in a system hang rather than a clean panic/reboot, preventing crash dump collection and recovery. This affects systems using IBM POWER hardware with RTAS support. There is no known confidentiality or integrity impact, and the vulnerability is not exploitable by an unprivileged attacker to gain elevated access (Feedly).

Update the Linux kernel to a patched stable release: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.17, 6.1.3, or 6.2 (mainline). The fix is included in the upstream stable tree commits referenced by the kernel security team. SUSE has also issued a kernel security advisory (SUSE-2026-0350) incorporating this fix for affected SUSE Linux Enterprise distributions (Linux Security, Feedly). No configuration-based workaround is available; upgrading the kernel is the only remediation.