CVE-2025-38276: 
Linux Ubuntu vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered in the fs/dax component related to the handling of locked entries when scanning entries. The issue was identified and assigned CVE-2025-38276, with the initial disclosure on July 10, 2025. The vulnerability affects the Linux kernel's implementation of Direct Access (DAX) filesystem functionality (NVD).

The vulnerability stems from a function called wait_entry_unlocked_exclusive(), which was introduced by commit 6be3e21d25ca. This function waits for the current entry to become unlocked without advancing the XArray iterator state. The issue arises because waiting for the entry to become unlocked requires dropping the XArray lock and calling xas_pause(), which inadvertently advances the xas state to the next index. While xas_for_each() typically handles this state change, both the callers and wait_entry_unlocked_exclusive() itself use the xas state to reload the entry, causing the current entry being waited on to be skipped (NVD).

The vulnerability can trigger intermittent warnings when running xftest generic/068 on an XFS filesystem with FS DAX enabled. This can lead to system instability and potential data integrity issues in DAX-enabled filesystems (NVD).