CVE-2022-49849: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability identified as CVE-2022-49849 was discovered in the Linux kernel's btrfs filesystem component. The issue was found by the syzkaller fuzzing tool and involves incorrect matching in the dev_args_match_device function. The vulnerability was disclosed on May 1, 2025 (NVD, Wiz).

The vulnerability occurs when devid is set to (u64)-1 by ioctl in the btrfs filesystem. This causes the devid match to be skipped, potentially leading to incorrect device matching. The issue stems from a failed assertion: (args->devid != (u64)-1) || args->missing, in fs/btrfs/volumes.c:6921. The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (Red Hat XML).

When exploited, this vulnerability could lead to incorrect device matching in the btrfs filesystem, potentially causing system instability or unintended behavior. The vulnerability particularly affects the high-availability aspects of the system (Wiz).

Red Hat has assessed that several versions of their products are not affected by this vulnerability, including Red Hat Enterprise Linux 8 and 9. For affected systems, updating to a patched version of the Linux kernel that includes the fix for this vulnerability is recommended (Red Hat XML).