$ the-wire · showcase
Arch ships a CLONE_NEWUSER kill switch in v7.2.6-arch2
By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology
The day's real work is in the kernel: Arch's v7.2.6-arch2 adds a sysctl to disable unprivileged user namespaces, while Linus pulled RDMA and MM hotfix batches into the tree.
Arch Linux kernel v7.2.6-arch2 archlinux/linux
The -arch2 build applies a patch adding a sysctl to allow disabling unprivileged CLONE_NEWUSER on top of stable v7.2.6, plus a drm/amd/display fix dropping an unnecessary SIGNAL_TYPE_HDMI_TYPE_A check. That gives you a runtime toggle for unprivileged user namespaces, the same surface most container escapes and kernel LPE chains are built on.
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma archlinux/linux
Jason Gunthorpe's rdma fixes land as "Lots of bug fixes from the last weeks," among them error unwind bugs, several races and bugs in siw and rxe that the pull note flags as remote triggerable, HFI1 credit-scheme corruption, a bogus user-triggerable dev_warn, proper locking of __ethtool_get_link_ksettings(), and a lockdep loop on disassociation. The remote-triggerable rxe and siw entries are th...
Merge tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm archlinux/linux
Andrew Morton's batch carries 14 hotfixes, 10 marked cc:stable and 11 in MM, all singletons, including EXPORT_SYMBOL_FOR_KVM(lru_cache_drain_for_folio) and a fix for set_shrinker_bit() under cgroup.memory=nokmem. Because the bulk is tagged stable, these are destined for the stable trees your running kernel is built from.
Merge tag 'nfsd-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux archlinux/linux
Chuck Lever's nfsd fix corrects handling of NFSEXP_PNFS in the netlink codepath, the export reconfigure path used by nfsd's newer netlink interface rather than the legacy nfs.conf.
Arch Linux kernel v7.2.6-arch1 archlinux/linux
The -arch1 build carried the same unprivileged CLONE_NEWUSER sysctl alone on top of v7.2.6; elsewhere, BlackIkeEagle pushed mpd 0.24.15-3, kodi 21.3-11, xine-lib 1.2.13-22 and two kodi addons into extra-testing, and signstar added the missing ExportWrapped permission to the administrative key's delegated set, without which a wrapping key marked ExportWrapped cannot be installed.
