CVE-2025-22014

What it actually does

Race condition in Linux kernel soc:qcom:pdr allows concurrent pdr_add_lookup and pdr_locator_new_server paths to deadlock on the same list_lock while an ordered workqueue blocks completion, producing timeout errors on domain list queries.

Why it matters to the business

Systems using Qualcomm hardware may experience hangs or degraded service registration (including audio), requiring reboots and interrupting operations until patched; the issue affects downstream Linux kernel users broadly.

How an attack unfolds

Local processes trigger the race by calling pdr_add_lookup while a concurrent new-server packet sets locator_init_complete, causing both paths to contend on list_lock inside the ordered qmi workqueue and deadlock.

How to fix it

Update the Linux kernel to commit 72a222b6af10c2a05a5fad0029246229ed8912c2 or later; apply the fix that removes the list iteration inside pdr_locator_new_server and simply calls schedule_work.

How to confirm the fix worked

Verify the applied kernel contains commit 72a222b6af10c2a05a5fad0029246229ed8912c2; reproduce the original race under load and confirm absence of the deadlock timeout logs.

Typical attack path

1. Invoke pdr_add_lookup from process A to schedule locator work
2. Deliver new server packet from process B to set locator_init_complete and acquire list_lock
3. Have process A acquire list_lock inside pdr_locator_work while waiting on ordered workqueue
4. Observe timeout on pdr_get_domain_list and resulting deadlock

How to detect it

Search kernel logs and dmesg for the exact timeout messages indicating failed domain-list transactions and service lookup failures in the PDR subsystem.

• PDR: tms/servreg get domain list txn wait failed: -110
• PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110

What your security team should do

• Prioritize kernel upgrade on all Qualcomm-based systems
• Scan logs for the specific PDR timeout strings to identify affected hosts
• Test audio and service-registration workloads after patching