CVE-2022-50091

locking/csd_lock: Change csdlock_debug from early_param to __setup

MEDIUM
5.5
CVSS Score
Published: June 18, 2025 at 11:02 AM UTC
Updated: June 17, 2026 at 05:22 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: locking/csd_lock: Change csdlock_debug from early_param to __setup The csdlock_debug kernel-boot parameter is parsed by the early_param() function csdlock_debug(). If set, csdlock_debug() invokes static_branch_enable() to enable csd_lock_wait feature, which triggers a panic on arm64 for kernels built with CONFIG_SPARSEMEM=y and CONFIG_SPARSEMEM_VMEMMAP=n. With CONFIG_SPARSEMEM_VMEMMAP=n, __nr_to_section is called in static_key_enable() and returns NULL, resulting in a NULL dereference because mem_section is initialized only later in sparse_init(). This is also a problem for powerpc because early_param() functions are invoked earlier than jump_label_init(), also resulting in static_key_enable() failures. These failures cause the warning "static key 'xxx' used before call to jump_label_init()". Thus, early_param is too early for csd_lock_wait to run static_branch_enable(), so changes it to __setup to fix these.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.13 ≤ v < 5.15.615.13 ≤ v < 5.18.185.13 ≤ v < 5.19.25.13 ≤ v < 6.05.16 ≤ v < 5.18.185.19 ≤ v < 5.19.25.138d0968cc6b8ffd8496c2ebffdfdc801f949a85e5
Vendor states this is fixed in 05de9e2e33b1625c71aee69e353fe906dd2be88a (fixed)
Vendor states this is fixed in 9c9b26b0df270d4f9246e483a44686fca951a29c (fixed)
Vendor states this is fixed in b480d1e9a8c11ecc1c99dc01814b28e3103bd0a0 (fixed)
Vendor states this is fixed in d2cbdbe22b5f190055d2d0ae92e7454479343a30 (fixed)
Vendor states this is fixed in 5.13 (unaffected)
Vendor states this is fixed in 5.15.61 (unaffected)
Vendor states this is fixed in 5.18.18 (unaffected)
Vendor states this is fixed in 5.19.2 (unaffected)
Vendor states this is fixed in 6.0 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/05de9e2e33b1625c71aee69e353fe906dd2be88a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9c9b26b0df270d4f9246e483a44686fca951a29c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b480d1e9a8c11ecc1c99dc01814b28e3103bd0a0
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d2cbdbe22b5f190055d2d0ae92e7454479343a30

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card