CVE-2022-49079: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49079 affects the Linux kernel's btrfs filesystem component, specifically in the zoned device functionality. The vulnerability was discovered in the btrfscanactivatezone() function which could lead to a deadlock condition when the devicelist_mutex is already held (Kernel Git).

The vulnerability occurs in the btrfscanactivatezone() function where a recursive locking scenario can happen. The function attempts to acquire devicelistmutex while it's already being held, leading to a deadlock. The issue manifests in the call chain: insertdevextents() -> insertdevextent() -> btrfsinsertemptyitem() -> btrfssearchslot() -> btrfscowblock() -> _btrfscowblock() -> btrfsalloctreeblock() -> btrfsreserveextent() -> findfreeextent() -> findfreeextentupdateloop() -> canallocatechunk() -> btrfscanactivate_zone() (Kernel Git).

The vulnerability can cause system deadlocks when operating on btrfs filesystems with zoned devices. This could potentially lead to system hangs and affect the availability of the system running the affected kernel version (Kernel Git).

The issue was fixed by modifying the btrfscanactivatezone() function to use fsdevices->alloclist protected by the chunkmutex instead of using RCU on fsdevices->devicelist. The fix was implemented in the Linux kernel and backported to stable kernel versions 5.16 and later (Kernel Git).