Who contributed to Linux on July 24, 2026?

6 developers shipped this update, including Doruk Tan Ozturk, Yuxiang Yang, David Heinemeier Hansson, Martín Ramírez Espinosa, renovate, and codefiles.

What were the notable Linux updates?

vxlan: require CAP_NET_ADMIN in the device netns for changelink, geneve: require CAP_NET_ADMIN in the device netns for changelink, and mac802154: hold an interface reference across the scan worker.

Linux

The kernel, distros, and the rigs of the moment

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

KERNEL PATCHES CLOSE NAMESPACE PRIVILEGE ESCALATION GAPS IN TUNNEL DRIVERS

By RepoJournal · Filed 06:57 UTC on July 24, 2026 · About Linux

6 people shipped this

Doruk Tan Ozturk @peaktwilight 2 cited

Yuxiang Yang @yyxRoy 2 cited

David Heinemeier Hansson @dhh 1 cited

renovate @renovate 1 cited

codefiles @codefiles 1 cited

Martín Ramírez Espinosa @almondsun

Two critical fixes close a privilege escalation hole in VXLAN and GENEVE tunnel changelink operations that allowed unprivileged callers in one namespace to rewrite devices whose underlay lives elsewhere.

The kernel team shipped emergency patches to VXLAN [1] and GENEVE [2] that enforce CAP_NET_ADMIN checks against both the device netns and the sticky underlay netns. The vulnerability allowed a caller privileged in dev_net(dev) but not in the underlay netns to rewrite tunnel configuration, exposing multitenancy setups. In parallel, the TCP stack got RFC 9293 compliance work: the SYN-RECEIVED path now sends challenge ACKs for non-exact in-window RSTs [5] instead of silently dropping them, with full packetdrill coverage [4] validating the fix. A separate reference-counting fix [3] in mac802154 prevents use-after-free in the scan worker by holding an interface reference across the RCU-protected section. Across the Linux desk alone, 91 commits landed in 24 hours. Outside the kernel, Omarchy pushed fingerprint authentication to lock screens and polkit dialogs [6], while ArchInstall bumped Ruff to v0.16.0 [8] and refactored Pydantic validators [7] for correctness.

Action items

→ Apply VXLAN and GENEVE CAP_NET_ADMIN patches [ref:1] [ref:2] to any multitenancy setup immediately torvalds/linux [immediate]
→ Update ArchInstall and validate Ruff v0.16.0 [ref:14] integration before next release archlinux/archinstall [plan]
→ Monitor TCP implementations for SYN-RECEIVED RST handling compliance [ref:5] torvalds/linux [monitor]

References

[1] vxlan: require CAP_NET_ADMIN in the device netns for changelink torvalds/linux
[2] geneve: require CAP_NET_ADMIN in the device netns for changelink torvalds/linux
[3] mac802154: hold an interface reference across the scan worker torvalds/linux
[4] selftests/net: packetdrill: cover RST validation in SYN-RECEIVED torvalds/linux
[5] tcp: challenge ACK for non-exact RST in SYN-RECEIVED torvalds/linux
[6] Show fingerprint on lock screen and polkit, gated by lid state basecamp/omarchy
[7] Refactor MirrorStatusEntryV3 field validator ↗ archlinux/archinstall
[8] Update dependency ruff to v0.16.0 ↗ archlinux/archinstall

Quick answers

What shipped in Linux on July 24, 2026?: Two critical fixes close a privilege escalation hole in VXLAN and GENEVE tunnel changelink operations that allowed unprivileged callers in one namespace to rewrite devices whose underlay lives elsewhere. In total, 91 commits and 9 pull requests landed.
Who contributed to Linux on July 24, 2026?: 6 developers shipped this update, including Doruk Tan Ozturk, Yuxiang Yang, David Heinemeier Hansson, Martín Ramírez Espinosa, renovate, and codefiles.
What were the notable Linux updates?: vxlan: require CAP_NET_ADMIN in the device netns for changelink, geneve: require CAP_NET_ADMIN in the device netns for changelink, and mac802154: hold an interface reference across the scan worker.

WATCHDOG UAF AND DIVISION-BY-ZERO FIXES LAND IN V7.2-RC5

Linus merged critical watchdog subsystem patches addressing a use-after-free vulnerability and a zero-division crash that could tank embedded systems in production.

infra 40 shipped 1-min read

Linux 2 days ago

KERNEL RC5 LANDS WITH HWMON FIXES AND KVM STABILITY PATCHES

Linux 7.2-rc5 rolls out critical hardware monitoring fixes and RISC-V virtualization patches that tighten KVM stability across multiple architectures.

infra 47 shipped 2-min read

Linux 3 days ago

KERNEL HOTFIXES LAND AS OMARCHY CUTS IDLE WAKEUPS BY 66%

Andrew Morton merged 12 memory management fixes overnight while the desktop shell team eliminated the largest source of pointless CPU wakeups on idle systems.

infra 37 shipped 1-min read

Linux 4 days ago

KERNEL BLOCKS DIO BOUNCE BUFFER CRASHES WHILE RISC-V VMEMMAP FIX LANDS

Block layer fixes restore bio allocation safety and prevent double-unpin crashes, while RISC-V patches eliminate spurious PTE faults and vDSO compiler elision.

infra 47 shipped 2-min read

Elsewhere on the wire

AI Agents about 1 hour ago

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

ai-agents 62 shipped 1-min read

Local LLMs about 1 hour ago

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

llms 157 shipped 2-min read

@CachyOS about 1 hour ago

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

infra 57 shipped 1-min read

Elixir & Phoenix about 1 hour ago

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.