CVE-2022-49371: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a deadlock vulnerability was discovered in the __device_attach function. The issue occurs when async probes are allowed but fail due to out of memory conditions or work limits, causing a deadlock because __device_attach_async_helper attempts to acquire a lock that is already held (Kernel Git).

The vulnerability exists in the lock holding logic of __device_attach function. When async probes are allowed, the function holds device_lock(dev) while calling async_schedule_dev(__device_attach_async_helper, dev). If the async scheduling fails due to memory allocation failure or exceeding work limits, it executes the function synchronously while still holding the lock. Since __device_attach_async_helper also attempts to acquire the same lock, this leads to an A-A deadlock condition (Kernel Git).

The vulnerability can cause system deadlocks when device probing occurs under memory pressure or high workload conditions. This could potentially affect system stability and availability, particularly during device initialization or hot-plug events (NVD).

The vulnerability requires specific conditions to trigger - namely async probes must be enabled and the system must be under memory pressure or high workload. It appears to be primarily a reliability issue rather than a security vulnerability that can be deliberately exploited (NVD).

The issue has been fixed by moving the async_schedule_dev call outside the device_lock. This is safe because the system_unbound_wq used in async_schedule_node_domain can handle concurrent operations. The fix was implemented in the Linux kernel through a patch that modifies the lock handling sequence (Kernel Git).