CVE-2025-38276: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38276 is an improper locking vulnerability in the Linux kernel's DAX (Direct Access) filesystem subsystem. It was introduced by commit 6be3e21d25ca ("fs/dax: don't skip locked entries when scanning entries"), which added wait_entry_unlocked_exclusive() — a function that incorrectly advances the XArray iterator state after calling xas_pause(), causing locked entries to be skipped during scanning. The vulnerability affects Linux kernel versions 6.15.x before 6.15.3 and was published on July 10, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-667 (Improper Locking). The wait_entry_unlocked_exclusive() function in fs/dax must drop the XArray lock while waiting for an entry to become unlocked, which requires calling xas_pause() first. However, xas_pause() advances the XArray iterator (xas) to the next index as a side effect. When the function subsequently reloads the entry using the now-advanced xas state, the original locked entry is skipped rather than re-examined, leading to an intermittent kernel warning (WARNING: CPU: ... at mm/truncate.c:89 truncate_folio_batch_exceptionals) observable when running xfstests generic/068 on XFS with FS DAX enabled. Exploitation requires local access with low privileges and no user interaction (Feedly, Kernel Patch 1, Kernel Patch 2).

The vulnerability has no confidentiality or integrity impact; its sole consequence is a high availability impact on the affected system. A local, low-privileged user on a system running Linux kernel 6.15.x (before 6.15.3) with DAX-enabled XFS (or other DAX-capable filesystems) can trigger the improper locking condition, potentially causing kernel warnings, filesystem inconsistencies, or system instability. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-38276. The EPSS score is very low at approximately 0.018%, reflecting minimal likelihood of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue manifests intermittently under specific workloads (e.g., DAX-enabled XFS with concurrent truncation operations) rather than being reliably triggerable on demand (Feedly).

The fix is available in Linux kernel version 6.15.3, addressed via two upstream stable patches. Administrators running kernel 6.15.x on systems with DAX-enabled filesystems (e.g., XFS with dax mount option and persistent memory devices such as nd_pmem) should upgrade to 6.15.3 or later. An Oracle Linux advisory has also been issued for affected enterprise distributions. No configuration-based workaround is documented; disabling DAX on the filesystem (removing the dax mount option) would eliminate exposure if upgrading is not immediately feasible (Kernel Patch 1, Kernel Patch 2, Oracle Advisory).