diff --git a/arch/arm64/kvm/hyp/include/nvhe/mm.h b/arch/arm64/kvm/hyp/include/nvhe/mm.h
index 66a6d71bd4e0..ed2e8ab8d236 100644
--- a/arch/arm64/kvm/hyp/include/nvhe/mm.h
+++ b/arch/arm64/kvm/hyp/include/nvhe/mm.h
@@ -34,4 +34,9 @@ void pkvm_remove_mappings(void *from, void *to);
 int __pkvm_map_module_page(u64 pfn, void *va, enum kvm_pgtable_prot prot, bool is_protected);
 void __pkvm_unmap_module_page(u64 pfn, void *va);
 void *__pkvm_alloc_module_va(u64 nr_pages);
+#ifdef CONFIG_NVHE_EL2_DEBUG
+void assert_in_mod_range(unsigned long addr);
+#else
+static inline void assert_in_mod_range(unsigned long addr) { }
+#endif /* CONFIG_NVHE_EL2_DEBUG */
 #endif /* __KVM_HYP_MM_H */
diff --git a/arch/arm64/kvm/hyp/nvhe/mm.c b/arch/arm64/kvm/hyp/nvhe/mm.c
index 76f26dc73cc7..672676c20e9c 100644
--- a/arch/arm64/kvm/hyp/nvhe/mm.c
+++ b/arch/arm64/kvm/hyp/nvhe/mm.c
@@ -115,7 +115,7 @@ static void update_mod_range(unsigned long addr, size_t size)
 	hyp_spin_unlock(&mod_range_lock);
 }
 
-static void assert_in_mod_range(unsigned long addr)
+void assert_in_mod_range(unsigned long addr)
 {
 	/*
 	 * This is not entirely watertight if there are private range
@@ -128,7 +128,6 @@ static void assert_in_mod_range(unsigned long addr)
 }
 #else
 static inline void update_mod_range(unsigned long addr, size_t size) { }
-static inline void assert_in_mod_range(unsigned long addr) { }
 #endif
 
 void *__pkvm_alloc_module_va(u64 nr_pages)
diff --git a/arch/arm64/kvm/hyp/nvhe/modules.c b/arch/arm64/kvm/hyp/nvhe/modules.c
index 7eda0724d7f6..eb7b6680f2d1 100644
--- a/arch/arm64/kvm/hyp/nvhe/modules.c
+++ b/arch/arm64/kvm/hyp/nvhe/modules.c
@@ -137,6 +137,8 @@ int __pkvm_register_hcall(unsigned long hvn_hyp_va)
 	dyn_hcall_t hfn = (void *)hvn_hyp_va;
 	int reserved_id, ret;
 
+	assert_in_mod_range(hvn_hyp_va);
+
 	hyp_spin_lock(&dyn_hcall_lock);
 
 	reserved_id = atomic_read(&num_dynamic_hcalls);