CVE-2022-50870

What it actually does

Race condition in powerpc rtas_os_term() that performs device tree traversal under devtree_lock during panic, risking deadlock or hang if the lock is already held.

Why it matters to the business

Kernel panics on affected PowerPC Linux systems may result in an unrecoverable hang instead of clean shutdown or reboot, increasing downtime and complicating incident response.

How an attack unfolds

An attacker or workload triggers a kernel panic while another thread holds devtree_lock; rtas_os_term() then attempts the locked traversal, causing the system to hang rather than terminate cleanly.

How to fix it

Update Linux kernel to commit e23822c7381c59d9e42e65771b6e17c71ed30ea7 or later stable release that caches the rtas properties at boot.

How to confirm the fix worked

Verify kernel source contains the static caching variables and of_property_read_bool change for ibm,extended-os-term; confirm no device tree lookups remain in rtas_os_term().

Typical attack path

1. Trigger kernel panic path on PowerPC system
2. Ensure devtree_lock is held by concurrent thread
3. Invoke rtas_os_term() which performs unsafe device tree lookup
4. System hangs instead of completing panic handling

How to detect it

Review kernel panic logs and stack traces on PowerPC for rtas_os_term() calls coinciding with held devtree_lock; check for repeated hangs during panic rather than successful reboot.

What your security team should do

• Apply the referenced kernel commit immediately on all PowerPC systems
• Test panic handling paths after upgrade to confirm clean termination
• Monitor for future powerpc/rtas changes in stable kernels