CVE-2025-38276

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/dax: Fix "don't skip locked entries when scanning entries"

Commit 6be3e21d25ca ("fs/dax: don't skip locked entries when scanning

entries") introduced a new function, wait_entry_unlocked_exclusive(),

which waits for the current entry to become unlocked without advancing

the XArray iterator state.

Waiting for the entry to become unlocked requires dropping the XArray

lock. This requires calling xas_pause() prior to dropping the lock

which leaves the xas in a suitable state for the next iteration. However

this has the side-effect of advancing the xas state to the next index.

Normally this isn't an issue because xas_for_each() contains code to

detect this state and thus avoid advancing the index a second time on

the next loop iteration.

However both callers of and wait_entry_unlocked_exclusive() itself

subsequently use the xas state to reload the entry. As xas_pause()

updated the state to the next index this will cau

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References