Skip to content
Heist/ feed
Back to feed
UnratedFix available

static_call: Handle module init failure correctly in static_call_del_module()

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and

Products
Kernel
Affected versions
Not specified
Fixed versions
5.15.168, 6.1.113, 6.10.14, 6.11.3, 6.6.55
CVEs
CVE-2024-50002
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 18:34 UTC · Revision 1

Source evidence

static_call: Handle module init failure correctly in static_call_del_module()

core-osv · Original source

Published 21 Oct 2024, 18:02 UTC

In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and

osv:CVE-2024-50002

Kernel

Fixed versions: 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3

Complete source record
{
  "id": "b15956d7e35c80a9f9af608ccea23b4e9d3a7ba1409a8c75c5ee7dad430cafeb",
  "url": "https://osv.dev/vulnerability/CVE-2024-50002",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "static_call: Handle module init failure correctly in static_call_del_module()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and",
    "evidence": "osv:CVE-2024-50002",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.168",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.113",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.55",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.10.14",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.11.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2024-50002",
      "aliases": [
        "CVE-2024-50002"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "9183c3f9ed710a8edf1a61e8a96d497258d26e08"
                },
                {
                  "fixed": "ed4c8ce0f307f2ab8778aeb40a8866d171e8f128"
                },
                {
                  "fixed": "b566c7d8a2de403ccc9d8a06195e19bbb386d0e4"
                },
                {
                  "fixed": "c0abbbe8c98c077292221ec7e2baa667c9f0974c"
                },
                {
                  "fixed": "2b494471797bff3d257e99dc0a7abb0c5ff3b4cd"
                },
                {
                  "fixed": "9c48c2b53191bf991361998f5bb97b8f2fc5a89c"
                },
                {
                  "fixed": "4b30051c4864234ec57290c3d142db7c88f10d8a"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50002.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.10.0"
                },
                {
                  "fixed": "5.15.168"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.113"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.55"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.10.14"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.11.0"
                },
                {
                  "fixed": "6.11.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50002.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.695451367Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2b494471797bff3d257e99dc0a7abb0c5ff3b4cd",
        "https://git.kernel.org/stable/c/4b30051c4864234ec57290c3d142db7c88f10d8a",
        "https://git.kernel.org/stable/c/9c48c2b53191bf991361998f5bb97b8f2fc5a89c",
        "https://git.kernel.org/stable/c/b566c7d8a2de403ccc9d8a06195e19bbb386d0e4",
        "https://git.kernel.org/stable/c/c0abbbe8c98c077292221ec7e2baa667c9f0974c",
        "https://git.kernel.org/stable/c/ed4c8ce0f307f2ab8778aeb40a8866d171e8f128",
        "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50002.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-50002",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50002.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-50002",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 520098,
  "published_at": "2024-10-21T18:02:40.908+00:00"
}