Linux Kernel 5.0

In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Mishandling of file-system uid/gid with namespaces in shiftfs

In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.

Reference count underflow in shiftfs

Type confusion in shiftfs

In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.

net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

net_sched: qfq: Fix double list add in class with netem as child qdisc

net_sched: drr: Fix double list add in class with netem as child qdisc

net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down

seg6: fix the iif in the IPv6 socket control block

Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs

In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related to the vmwgfx or ttm module.

blk-iolatency: Fix inflight count imbalances and IO hangs on offline

bridge: switchdev: Fix memory leaks when changing VLAN protocol

net: usb: aqc111: Do not perform PM inside suspend callback