PT-2025-15402 · Linux+6 · Linux Kernel+6

Published

2025-04-08

·

Updated

2026-04-20

·

CVE-2025-22014

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: A potential deadlock issue has been resolved in the Linux kernel. The problem occurs when a client process calls pdr add lookup() to add a lookup for a service and schedules locator work. Later, another process receives a new server packet indicating the locator is up and calls pdr locator new server(), which sets pdr->locator init complete to true. This causes the first process to take a list lock and query the domain list, resulting in a timeout due to a deadlock. The response is queued to the same workqueue, and the second process cannot complete the new server request work due to the deadlock on the list lock.
The issue is fixed by removing unnecessary list iteration, as it is already being done inside the locator work. The fix involves calling schedule work() instead of iterating over the list.
The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
Technical details about exploitation include:
  • The pdr add lookup() function is called by a client process to add a lookup for a service.
  • The pdr locator new server() function is called when a new server packet is received, setting pdr->locator init complete to true.
  • The pdr locator work() function is scheduled to perform locator work.
  • The mutex lock(&pdr->list lock) function is used to take a list lock, which can cause a deadlock.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2025-12647
ALT-PU-2025-5786
AZL-59772
AZL-59907
BDU:2025-11783
CVE-2025-22014
DLA-4178-1
DLA-4193-1
DSA-5900-1
ECHO-3FA4-F523-5650
MGASA-2025-0142
MGASA-2025-0146
OESA-2025-1463
OESA-2025-1464
OPENSUSE-SU-2025_01614-1
OPENSUSE-SU-2025_01707-1
SUSE-SU-2025:01614-1
SUSE-SU-2025:01707-1
SUSE-SU-2025:01919-1
SUSE-SU-2025:01951-1
SUSE-SU-2025:01964-1
SUSE-SU-2025:01967-1
SUSE-SU-2025:20192-1
SUSE-SU-2025:20206-1
SUSE-SU-2025:20270-1
SUSE-SU-2025:20283-1
SUSE-SU-2025_01614-1
SUSE-SU-2025_01707-1
SUSE-SU-2025_01951-1
SUSE-SU-2025_01964-1
SUSE-SU-2025_01967-1
USN-7591-1
USN-7591-2
USN-7591-3
USN-7591-4
USN-7591-5
USN-7591-6
USN-7592-1
USN-7593-1
USN-7597-1
USN-7597-2
USN-7598-1
USN-7602-1
USN-7605-1
USN-7605-2
USN-7606-1
USN-7628-1
USN-7655-1
USN-7764-1
USN-7764-2
USN-7765-1
USN-7766-1
USN-7767-1
USN-7767-2
USN-7779-1
USN-7790-1
USN-7800-1
USN-7801-1
USN-7801-2
USN-7801-3
USN-7802-1
USN-7809-1

Affected Products

Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu