{"id":"CVE-2022-49079","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-49079","generatedAt":"2026-10-27T18:48:21.018Z","title":"In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone btrfs_can_activate_zone() can be called with the device_list_mutex already held, which will lead to a…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone\n\nbtrfs_can_activate_zone() can be called with the device_list_mutex already\nheld, which will lead to a deadlock:\n\ninsert_dev_extents() // Takes device_list_mutex\n`-> insert_dev_extent()\n `-> btrfs_insert_empty_item()\n  `-> btrfs_insert_empty_items()\n   `-> btrfs_search_slot()\n    `-> btrfs_cow_block()\n     `-> __btrfs_cow_block()\n      `-> btrfs_alloc_tree_block()\n       `-> btrfs_reserve_extent()\n        `-> find_free_extent()\n         `-> find_free_extent_update_loop()\n          `-> can_allocate_chunk()\n           `-> btrfs_can_activate_zone() // Takes device_list_mutex again\n\nInstead of using the RCU on fs_devices->device_list we\ncan use fs_devices->alloc_list, protected by the chunk_mutex to traverse\nthe list of active devices.\n\nWe are in the chunk allocation thread. The newer chunk allocation\nhappens from the devices in the fs_device->alloc_list protected by the\nchunk_mutex.\n\n  btrfs_create_chunk()\n    lockdep_assert_held(&info->chunk_mutex);\n    gather_device_info\n      list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list)\n\nAlso, a device that reappears after the mount won't join the alloc_list\nyet and, it will be in the dev_list, which we don't want to consider in\nthe context of the chunk alloc.\n\n  [15.166572] WARNING: possible recursive locking detected\n  [15.167117] 5.17.0-rc6-dennis #79 Not tainted\n  [15.167487] --------------------------------------------\n  [15.167733] kworker/u8:3/146 is trying to acquire lock:\n  [15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.167733]\n  [15.167733] but task is already holding lock:\n  [15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]\n  [15.167733]\n  [15.167733] other info that might help us debug this:\n  [15.167733]  Possible unsafe locking scenario:\n  [15.167733]\n  [15.171834]        CPU0\n  [15.171834]        ----\n  [15.171834]   lock(&fs_devs->device_list_mutex);\n  [15.171834]   lock(&fs_devs->device_list_mutex);\n  [15.171834]\n  [15.171834]  *** DEADLOCK ***\n  [15.171834]\n  [15.171834]  May be due to missing lock nesting notation\n  [15.171834]\n  [15.171834] 5 locks held by kworker/u8:3/146:\n  [15.171834]  #0: ffff888100050938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0\n  [15.171834]  #1: ffffc9000067be80 ((work_completion)(&fs_info->async_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c3/0x5a0\n  [15.176244]  #2: ffff88810521e620 (sb_internal){.+.+}-{0:0}, at: flush_space+0x335/0x600 [btrfs]\n  [15.176244]  #3: ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs]\n  [15.176244]  #4: ffff8881152e4b78 (btrfs-dev-00){++++}-{3:3}, at: __btrfs_tree_lock+0x27/0x130 [btrfs]\n  [15.179641]\n  [15.179641] stack backtrace:\n  [15.179641] CPU: 1 PID: 146 Comm: kworker/u8:3 Not tainted 5.17.0-rc6-dennis #79\n  [15.179641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014\n  [15.179641] Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  [15.179641] Call Trace:\n  [15.179641]  <TASK>\n  [15.179641]  dump_stack_lvl+0x45/0x59\n  [15.179641]  __lock_acquire.cold+0x217/0x2b2\n  [15.179641]  lock_acquire+0xbf/0x2b0\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  __mutex_lock+0x8e/0x970\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  ? lock_is_held_type+0xd7/0x130\n  [15.183838]  ? find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  find_free_extent+0x15a/0x14f0 [btrfs]\n  [15.183838]  ? _raw_spin_unlock+0x24/0x40\n  [15.183838]  ? btrfs_get_alloc_profile+0x106/0x230 [btrfs]\n  [15.187601]  btrfs_reserve_extent+0x131/0x260 [btrfs]\n  [15.\n---truncated---","published":"2025-02-26T07:00:45.000Z","lastModified":"2026-06-17T05:17:01.000Z","status":"Analyzed","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-667"],"affected":["linux/linux kernel"],"epss":{"score":0.00184,"percentile":0.07942,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/09e65ae515af2b24d6dc23af21719a3b41de83e5","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b9e66762aa0cda2a9c2d5542d64e04dac528fa6","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/142f822bd945a7be442a2916ec6167cc102c4183","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-49079","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}