CVE-2025-22014 is a vulnerability identified in the Linux kernel related to the Qualcomm (qcom) PDR (Protocol Data Router) subsystem. The issue arises from a potential deadlock condition triggered when multiple processes interact with the PDR service lookup and locator mechanisms. Specifically, when process A calls pdr_add_lookup() to add a lookup for a service and schedules locator work, process B may concurrently receive a new server packet indicating the locator is up and calls pdr_locator_new_server(). This function sets the flag pdr->locator_init_complete to true, which process A observes and then attempts to acquire a list lock to query the domain list. However, this leads to a deadlock because the response is queued to the same ordered workqueue (qmi->wq), and process B cannot complete the new server request work due to the list lock being held by process A. The deadlock manifests as a timeout error in the kernel logs, with messages such as "PDR: tms/servreg get domain list txn wait failed: -110" and "PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110". The root cause is unnecessary list iteration in the code path, which was fixed by removing redundant list iterations and ensuring that schedule_work() is called appropriately to avoid the deadlock. This fix also resolves an audio regression issue related to the in-kernel pd-mapper, which made the race condition easier to trigger. The vulnerability affects specific Linux kernel versions identified by the commit hash fbe639b44a82755d639df1c5d147c93f02ac5a0f. No CVSS score has been assigned yet, and there are no known exploits in the wild at the time of publication.

The deadlock vulnerability in the Linux kernel's Qualcomm PDR subsystem can lead to denial of service (DoS) conditions on affected systems. Specifically, processes relying on the PDR service lookup may experience timeouts and failures in service discovery, which can cascade into broader system instability or degraded functionality. For European organizations, particularly those deploying Linux-based embedded systems, mobile devices, or network infrastructure that utilize Qualcomm chipsets and the affected kernel versions, this could disrupt critical services. The audio regression fix linked to this vulnerability indicates that multimedia or telecommunication applications might also be impacted, potentially affecting user experience or operational communications. While the vulnerability does not appear to allow privilege escalation or remote code execution, the denial of service impact can be significant in environments requiring high availability, such as telecommunications providers, industrial control systems, and cloud infrastructure providers prevalent in Europe.

To mitigate this vulnerability, European organizations should prioritize updating their Linux kernel to the patched version that removes the redundant list iteration and properly schedules work to avoid deadlocks. This involves applying the specific commit identified by the hash fbe639b44a82755d639df1c5d147c93f02ac5a0f or later stable kernel releases that include this fix. For embedded and mobile devices using Qualcomm chipsets, vendors should be engaged to provide updated firmware or kernel patches. Additionally, organizations should audit their systems to identify deployments running affected kernel versions and assess the usage of the PDR subsystem, especially in audio and telecommunication stacks. Monitoring kernel logs for the specific timeout error messages can help detect attempts to exploit or trigger the deadlock. As a proactive measure, testing updates in staging environments is recommended to ensure no regressions occur post-patching. Finally, maintaining robust incident response plans for potential denial of service events will help minimize operational impact.