CVE-2022-50870 powerpc/rtas: avoid device tree lookups in rtas_os_term()
A race condition in the Linux kernel's powerpc RTAS handler can cause a system hang during panic if device tree locks are held.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50870?
CVE-2022-50870 is a denial of service vulnerability in Linux, published on 30 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: avoid device tree lookups in rtas_os_term()
rtas_os_term() is called during panic. Its behavior depends on a couple of conditions in the /rtas node of the device tree, the traversal of which entails locking and local IRQ state changes. If the kernel panics while devtree_lock is held, rtas_os_term() as currently written could hang.
Instead of discovering the relevant characteristics at panic time, cache them in file-static variables at boot. Note the lookup for "ibm,extended-os-term" is converted to of_property_read_bool() since it is a boolean property, not an RTAS function token.
[mpe: Incorporate suggested change from Nick]
Which versions are affected by CVE-2022-50870?
How do I fix CVE-2022-50870?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-50870 being exploited?
There is no known exploitation of CVE-2022-50870 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50870, GHSA-87x8-vfrq-6cww, UBUNTU-CVE-2022-50870.