CVE-2025-22030 is a concurrency vulnerability in the Linux kernel's memory management subsystem, specifically within the zswap feature that compresses pages in memory to improve performance. The vulnerability arises from a potential deadlock scenario involving the crypto subsystem's asynchronous compression context (acomp_ctx) management. The function zswap_cpu_comp_dead() holds a per-CPU mutex (acomp_ctx mutex) and calls crypto_free_acomp(), which in turn attempts to acquire the scomp_lock mutex. Conversely, crypto_alloc_acomp_node() acquires scomp_lock first and may trigger memory reclaim that attempts to acquire the per-CPU acomp_ctx mutex. This lock acquisition order inversion (ABBA deadlock) can cause tasks to deadlock when CPUs go offline or during memory reclaim operations. The fix involves moving the call to crypto_free_acomp() outside the per-CPU mutex lock in zswap_cpu_comp_dead(), ensuring that the mutexes are not held simultaneously in conflicting order. Additionally, the patch moves acomp_request_free() and kfree() calls for consistency and reduces the risk of subtle future locking issues. This vulnerability is a classic deadlock scenario caused by improper lock ordering in kernel code, which can lead to system hangs or degraded performance due to stalled kernel threads or CPU offline operations.

For European organizations relying on Linux-based systems, especially those using kernels with the affected zswap implementation, this vulnerability could lead to system instability or hangs during CPU offline events or under memory pressure conditions. This can affect servers, cloud infrastructure, and embedded devices running Linux kernels with the vulnerable code. The deadlock does not appear to allow privilege escalation or direct data compromise but can cause denial of service (DoS) by freezing kernel threads or preventing CPUs from going offline cleanly. This can impact availability of critical services, particularly in data centers or cloud environments where Linux is prevalent. Organizations with high availability requirements or those running large-scale Linux deployments may experience operational disruptions. However, since exploitation requires specific kernel conditions and is not known to be exploited in the wild, the immediate risk is moderate but should be addressed proactively.

European organizations should prioritize updating their Linux kernels to versions that include the fix for CVE-2025-22030. Kernel maintainers have resolved the deadlock by reordering lock acquisition and freeing operations in the zswap and crypto subsystems. Until patches are applied, organizations can mitigate risk by minimizing CPU offline events and memory pressure scenarios that trigger reclaim operations involving crypto_alloc_acomp_node(). Monitoring kernel logs for signs of deadlock or CPU offline failures can help detect attempts to trigger this issue. For custom or embedded Linux distributions, backporting the patch is recommended. Additionally, thorough testing of kernel updates in staging environments is advised to ensure stability. Organizations should also review kernel configuration options related to zswap and crypto to understand exposure and consider disabling zswap if it is not critical to their workloads, as a temporary workaround.