CVE-2022-50091

locking/csd_lock: Change csdlock_debug from early_param to __setup

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

locking/csd_lock: Change csdlock_debug from early_param to __setup

The csdlock_debug kernel-boot parameter is parsed by the

early_param() function csdlock_debug(). If set, csdlock_debug()

invokes static_branch_enable() to enable csd_lock_wait feature, which

triggers a panic on arm64 for kernels built with CONFIG_SPARSEMEM=y and

CONFIG_SPARSEMEM_VMEMMAP=n.

With CONFIG_SPARSEMEM_VMEMMAP=n, __nr_to_section is called in

static_key_enable() and returns NULL, resulting in a NULL dereference

because mem_section is initialized only later in sparse_init().

This is also a problem for powerpc because early_param() functions

are invoked earlier than jump_label_init(), also resulting in

static_key_enable() failures. These failures cause the warning "static

key 'xxx' used before call to jump_label_init()".

Thus, early_param is too early for csd_lock_wait to run

static_branch_enable(), so changes it to __setup to fix these.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Published
2025-06-18T11:02Z
EPSS history
Timeline
  • 18 JUN 11:02Z
    locking/csd_lock: Change csdlock_debug from early_param to __setup
    cvelistv5