CVE-2022-50870

Linux Kernel - Denial of Service via rtas_os_term() Device Tree Lookup

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid device tree lookups in rtas_os_term() rtas_os_term() is called during panic. Its behavior depends on a couple of conditions in the /rtas node of the device tree, the traversal of which entails locking and local IRQ state changes. If the kernel panics while devtree_lock is held, rtas_os_term() as currently written could hang. Instead of discovering the relevant characteristics at panic time, cache them in file-static variables at boot. Note the lookup for "ibm,extended-os-term" is converted to of_property_read_bool() since it is a boolean property, not an RTAS function token. [mpe: Incorporate suggested change from Nick]

Scores

EPSS 0.0018
EPSS Percentile 8.3%

Details

Status published
Products (25)
linux/Kernel 2.6.16 - 4.14.303linux
linux/Kernel 4.15.0 - 4.19.270linux
linux/Kernel 4.20.0 - 5.4.229linux
linux/Kernel 5.11.0 - 5.15.87linux
linux/Kernel 5.16.0 - 6.0.17linux
linux/Kernel 5.5.0 - 5.10.163linux
linux/Kernel 6.1.0 - 6.1.3linux
Linux/Linux < 2.6.16
Linux/Linux 088186ded490ced80758200cf8f906ed741df306 - 06a07fbb32b3a23eec20a42b1e64474da0a3b33e
Linux/Linux 088186ded490ced80758200cf8f906ed741df306 - 464d10e8d797454e16a173ef1292a446b2adf21c
... and 15 more
Published Dec 30, 2025
Tracked Since Feb 18, 2026