{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-38276 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38276 is a high-severity vulnerability in Linux kernel, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38276 and fix it if it is affected.\n\nWhat it is: CVE-2025-38276 is a high-severity vulnerability in Linux kernel, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38276 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38276/ (Markdown: https://insights.sbomify.com/CVE-2025-38276/index.md)","id":"CVE-2025-38276","markdown":"https://insights.sbomify.com/CVE-2025-38276/index.md","name":"CVE-2025-38276","record":{"aliases":["BELL-CVE-2025-38276","GHSA-rpxc-pcjp-7jp2","UBUNTU-CVE-2025-38276"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel DAX","requires_auth":"low_privilege","summary":"A race condition in Linux kernel DAX filesystem handling causes skipped entries, leading to kernel warnings and potential denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-667","name":"Improper Locking"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/dax: Fix \"don't skip locked entries when scanning entries\"\n\nCommit 6be3e21d25ca (\"fs/dax: don't skip locked entries when scanning\nentries\") introduced a new function, wait_entry_unlocked_exclusive(),\nwhich waits for the current entry to become unlocked without advancing\nthe XArray iterator state.\n\nWaiting for the entry to become unlocked requires dropping the XArray\nlock. This requires calling xas_pause() prior to dropping the lock\nwhich leaves the xas in a suitable state for the next iteration. However\nthis has the side-effect of advancing the xas state to the next index.\nNormally this isn't an issue because xas_for_each() contains code to\ndetect this state and thus avoid advancing the index a second time on\nthe next loop iteration.\n\nHowever both callers of and wait_entry_unlocked_exclusive() itself\nsubsequently use the xas state to reload the entry. As xas_pause()\nupdated the state to the next index this will cause the current entry\nwhich is being waited on to be skipped. This caused the following\nwarning to fire intermittently when running xftest generic/068 on an XFS\nfilesystem with FS DAX enabled:\n\n[   35.067397] ------------[ cut here ]------------\n[   35.068229] WARNING: CPU: 21 PID: 1640 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xd8/0x1e0\n[   35.069717] Modules linked in: nd_pmem dax_pmem nd_btt nd_e820 libnvdimm\n[   35.071006] CPU: 21 UID: 0 PID: 1640 Comm: fstest Not tainted 6.15.0-rc7+ #77 PREEMPT(voluntary)\n[   35.072613] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/204\n[   35.074845] RIP: 0010:truncate_folio_batch_exceptionals+0xd8/0x1e0\n[   35.075962] Code: a1 00 00 00 f6 47 0d 20 0f 84 97 00 00 00 4c 63 e8 41 39 c4 7f 0b eb 61 49 83 c5 01 45 39 ec 7e 58 42 f68\n[   35.079522] RSP: 0018:ffffb04e426c7850 EFLAGS: 00010202\n[   35.080359] RAX: 0000000000000000 RBX: ffff9d21e3481908 RCX: ffffb04e426c77f4\n[   35.081477] RDX: ffffb04e426c79e8 RSI: ffffb04e426c79e0 RDI: ffff9d21e34816e8\n[   35.082590] RBP: ffffb04e426c79e0 R08: 0000000000000001 R09: 0000000000000003\n[   35.083733] R10: 0000000000000000 R11: 822b53c0f7a49868 R12: 000000000000001f\n[   35.084850] R13: 0000000000000000 R14: ffffb04e426c78e8 R15: fffffffffffffffe\n[   35.085953] FS:  00007f9134c87740(0000) GS:ffff9d22abba0000(0000) knlGS:0000000000000000\n[   35.087346] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   35.088244] CR2: 00007f9134c86000 CR3: 000000040afff000 CR4: 00000000000006f0\n[   35.089354] Call Trace:\n[   35.089749]  \u003cTASK\u003e\n[   35.090168]  truncate_inode_pages_range+0xfc/0x4d0\n[   35.091078]  truncate_pagecache+0x47/0x60\n[   35.091735]  xfs_setattr_size+0xc7/0x3e0\n[   35.092648]  xfs_vn_setattr+0x1ea/0x270\n[   35.093437]  notify_change+0x1f4/0x510\n[   35.094219]  ? do_truncate+0x97/0xe0\n[   35.094879]  do_truncate+0x97/0xe0\n[   35.095640]  path_openat+0xabd/0xca0\n[   35.096278]  do_filp_open+0xd7/0x190\n[   35.096860]  do_sys_openat2+0x8a/0xe0\n[   35.097459]  __x64_sys_openat+0x6d/0xa0\n[   35.098076]  do_syscall_64+0xbb/0x1d0\n[   35.098647]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   35.099444] RIP: 0033:0x7f9134d81fc1\n[   35.100033] Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 2a 26 0e 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff5\n[   35.102993] RSP: 002b:00007ffcd41e0d10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101\n[   35.104263] RAX: ffffffffffffffda RBX: 0000000000000242 RCX: 00007f9134d81fc1\n[   35.105452] RDX: 0000000000000242 RSI: 00007ffcd41e1200 RDI: 00000000ffffff9c\n[   35.106663] RBP: 00007ffcd41e1200 R08: 0000000000000000 R09: 0000000000000064\n[   35.107923] R10: 00000000000001a4 R11: 0000000000000202 R12: 0000000000000066\n[   35.109112] R13: 0000000000100000 R14: 0000000000100000 R15: 0000000000000400\n[   35.110357]  \u003c/TASK\u003e\n[   35.110769] irq event stamp: 8415587\n[   35.111486] hardirqs last  enabled at (8415599): [\u003cffffffff8d74b562\u003e] __up_console_se\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"fs/dax: Fix \"don't skip locked entries when scanning entries\"","id":"CVE-2025-38276","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"race_condition","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"mtd: nand: ecc-mxic: Fix use of uninitialized variable ret","id":"CVE-2025-38277"},"packages":[],"prev":{"headline":"phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug","id":"CVE-2025-38275"},"products":["Linux"],"published":"2025-07-10","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A race condition in Linux kernel DAX filesystem handling causes skipped entries, leading to kernel warnings and potential denial of service.","url":"https://insights.sbomify.com/CVE-2025-38276/"}