---
id: CVE-2022-50091
title: 'locking/csd_lock: Change csdlock_debug from early_param to __setup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  locking/csd_lock: Change csdlock_debug from early_param to __setup

  The csdlock_debug kernel-boot parameter is parsed by the
  early_param() function csdlock_debug().  If…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 <
    d2cbdbe22b5f190055d2d0ae92e7454479343a30
  - >-
    Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 <
    05de9e2e33b1625c71aee69e353fe906dd2be88a
  - >-
    Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 <
    b480d1e9a8c11ecc1c99dc01814b28e3103bd0a0
  - >-
    Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 <
    9c9b26b0df270d4f9246e483a44686fca951a29c
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:54:21.275116Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:16.759Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50091'
references:
  - url: 'https://git.kernel.org/stable/c/d2cbdbe22b5f190055d2d0ae92e7454479343a30'
  - url: 'https://git.kernel.org/stable/c/05de9e2e33b1625c71aee69e353fe906dd2be88a'
  - url: 'https://git.kernel.org/stable/c/b480d1e9a8c11ecc1c99dc01814b28e3103bd0a0'
  - url: 'https://git.kernel.org/stable/c/9c9b26b0df270d4f9246e483a44686fca951a29c'
tags:
  - cve.org
epss: 0.00252
epssPercentile: 0.16795
ingestedAt: '2026-11-05T22:38:31.654Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

locking/csd_lock: Change csdlock_debug from early_param to __setup

The csdlock_debug kernel-boot parameter is parsed by the
early_param() function csdlock_debug().  If set, csdlock_debug()
invokes static_branch_enable() to enable csd_lock_wait feature, which
triggers a panic on arm64 for kernels built with CONFIG_SPARSEMEM=y and
CONFIG_SPARSEMEM_VMEMMAP=n.

With CONFIG_SPARSEMEM_VMEMMAP=n, __nr_to_section is called in
static_key_enable() and returns NULL, resulting in a NULL dereference
because mem_section is initialized only later in sparse_init().

This is also a problem for powerpc because early_param() functions
are invoked earlier than jump_label_init(), also resulting in
static_key_enable() failures.  These failures cause the warning "static
key 'xxx' used before call to jump_label_init()".

Thus, early_param is too early for csd_lock_wait to run
static_branch_enable(), so changes it to __setup to fix these.

## Affected

- `Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 < d2cbdbe22b5f190055d2d0ae92e7454479343a30`
- `Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 < 05de9e2e33b1625c71aee69e353fe906dd2be88a`
- `Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 < b480d1e9a8c11ecc1c99dc01814b28e3103bd0a0`
- `Linux >= 8d0968cc6b8ffd8496c2ebffdfdc801f949a85e5 < 9c9b26b0df270d4f9246e483a44686fca951a29c`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.