fs/dax: Fix "don't skip locked entries when scanning entries"

{
  "id": "831bde1d9be64dd5e6c8e0836044a25c4967d6e9e32ba24f28e5534fe2b03179",
  "url": "https://osv.dev/vulnerability/CVE-2025-38276",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "fs/dax: Fix \"don't skip locked entries when scanning entries\"",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: fs/dax: Fix \"don't skip locked entries when scanning entries\" Commit 6be3e21d25ca (\"fs/dax: don't skip locked entries when scanning entries\") introduced a new function, wait_entry_unlocked_exclusive(), which waits for the current entry to become unlocked without advancing the XArray iterator state. Waiting for the entry to become unlocked requires dropping the XArray lock. This requires calling xas_pause() prior to dropping the lock which leaves the xas in a suitable state for the next iteration. However this has the side-effect of advancing the xas state to the next index. Normally this isn't an issue because xas_for_each() contains code to detect this state and thus avoid advancing the index a second time on the next loop iteration. However both callers of and wait_entry_unlocked_exclusive() itself subsequently use the xas state to reload the entry. As xas_pause() updated the state to the next index this will cause the current entry which is being waited on to be skipped. This caused the following warning to fire intermittently when running xftest generic/068 on an XFS filesystem with FS DAX enabled: [ 35.067397] ------------[ cut here ]------------ [ 35.068229] WARNING: CPU: 21 PID: 1640 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xd8/0x1e0 [ 35.069717] Modules linked in: nd_pmem dax_pmem nd_btt nd_e820 libnvdimm [ 35.071006] CPU: 21 UID: 0 PID: 1640 Comm: fstest Not tainted 6.15.0-rc7+ #77 PREE",
    "evidence": "osv:CVE-2025-38276",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.15.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-38276",
      "aliases": [
        "CVE-2025-38276"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6be3e21d25ca2dbb7ca4f3f7db808a3e1a944bd1"
                },
                {
                  "fixed": "61009dd2252ab4391d44a240e891f1e04c00b9ca"
                },
                {
                  "fixed": "dd59137bfe70cf3646021b4721e430213b9c71bd"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38276.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.15.0"
                },
                {
                  "fixed": "6.15.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38276.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.461252897Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/61009dd2252ab4391d44a240e891f1e04c00b9ca",
        "https://git.kernel.org/stable/c/dd59137bfe70cf3646021b4721e430213b9c71bd",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38276.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-38276",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38276.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-38276",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 507846,
  "published_at": "2025-07-10T07:41:56.288+00:00"
}