CVE-2022-49079: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49079 affects the Linux kernel's btrfs filesystem component, specifically in the zoned device functionality. The vulnerability was discovered in the btrfs_can_activate_zone() function which could lead to a deadlock condition when the device_list_mutex is already held (Kernel Git).

The vulnerability occurs in the btrfs_can_activate_zone() function where a recursive locking scenario can happen. The function attempts to acquire device_list_mutex while it's already being held, leading to a deadlock. The issue manifests in the call chain: insert_dev_extents() -> insert_dev_extent() -> btrfs_insert_empty_item() -> btrfs_search_slot() -> btrfs_cow_block() -> __btrfs_cow_block() -> btrfs_alloc_tree_block() -> btrfs_reserve_extent() -> find_free_extent() -> find_free_extent_update_loop() -> can_allocate_chunk() -> btrfs_can_activate_zone() (Kernel Git).

The vulnerability can cause system deadlocks when operating on btrfs filesystems with zoned devices. This could potentially lead to system hangs and affect the availability of the system running the affected kernel version (Kernel Git).

The vulnerability requires local access to a system running the affected kernel version with a btrfs filesystem using zoned devices. It is triggered through normal filesystem operations and doesn't require special privileges to exploit (Kernel Git).

The issue was fixed by modifying the btrfs_can_activate_zone() function to use fs_devices->alloc_list protected by the chunk_mutex instead of using RCU on fs_devices->device_list. The fix was implemented in the Linux kernel and backported to stable kernel versions 5.16 and later (Kernel Git).