Who contributed to Linux on August 7, 2026?

4 developers shipped this update, including Doruk Tan Ozturk, Eric Dumazet, Matthieu Baerts (NGI0), and David Heinemeier Hansson.

What were the notable Linux updates?

net: usb: ipheth: fix carrier_work UAF on disconnect, net: remove WARN_ON_ONCE() from sk_mc_loop(), and mptcp: avoid combining some incoming suboptions.

Linux

The kernel, distros, and the rigs of the moment

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

IPHETH DRIVER PLUGS USE-AFTER-FREE HOLE ON USB DISCONNECT

By RepoJournal · Filed 06:57 UTC on August 7, 2026 · About Linux

4 people shipped this

Matthieu Baerts (NGI0) @matttbe 2 cited

Doruk Tan Ozturk @peaktwilight 1 cited

Eric Dumazet @edumazet 1 cited

David Heinemeier Hansson @dhh

A critical use-after-free vulnerability in the iPhone USB tethering driver can leave kernel work queues armed after interface shutdown, exposing memory corruption on device unplug.

The ipheth driver had a dangerous gap in its disconnect path: carrier-check work could be re-armed after the interface closed and drained its queues, then survive until the netdev itself was freed [1]. This is the kind of race condition that persists silently until the hardware is unplugged with traffic in flight. Separately, Eric Dumazet removed a noisy WARN_ON from the multicast loop check that was triggering on non-INET sockets like AF_PACKET, which never supported multicast loopback options in the first place [2]. On the MPTCP side, Matthieu Baerts tightened suboption parsing to reject mutually exclusive combinations that the RFC forbids but the code wasn't prepared to handle, then cleaned up now-unreachable validation logic downstream [3] [4]. A fourth MPTCP fix addresses pathological receive-path drops that were leaking forward-allocated memory unboundedly when skbs hit errors before queueing [5].

Action items

→ Apply ipheth UAF fix [ref:1] immediately if running tethering over USB torvalds/linux [immediate]
→ Monitor MPTCP connection behavior after multipath receive-path hardening [ref:3] torvalds/linux [monitor]

References

[1] net: usb: ipheth: fix carrier_work UAF on disconnect torvalds/linux
[2] net: remove WARN_ON_ONCE() from sk_mc_loop() torvalds/linux
[3] mptcp: avoid combining some incoming suboptions torvalds/linux
[4] mptcp: remove MPC && MPJ check torvalds/linux
[5] mptcp: reclaim forward-allocated memory on RX path errors torvalds/linux

Quick answers

What shipped in Linux on August 7, 2026?: A critical use-after-free vulnerability in the iPhone USB tethering driver can leave kernel work queues armed after interface shutdown, exposing memory corruption on device unplug. In total, 48 commits landed.
Who contributed to Linux on August 7, 2026?: 4 developers shipped this update, including Doruk Tan Ozturk, Eric Dumazet, Matthieu Baerts (NGI0), and David Heinemeier Hansson.
What were the notable Linux updates?: net: usb: ipheth: fix carrier_work UAF on disconnect, net: remove WARN_ON_ONCE() from sk_mc_loop(), and mptcp: avoid combining some incoming suboptions.

KERNEL RC7 STABILIZES WITH HARDWARE FIXES ACROSS FIVE SUBSYSTEMS

Linus pulled five critical patch sets overnight targeting watchdog timer rearms, storage driver memory corruption, and GPU pipeline leaks before the final 7.2 release window closes.

infra 59 shipped

Linux Aug 6

KERNEL MEMORY FLUSH BUG HITS PAGE TABLE RECLAIM, SOC FIXES LAND ACROSS QUALCOMM AND BROADCOM

A critical memory management bug in direct page table reclaim is flushing the wrong address, potentially corrupting TLB state on architectures that depend on precise invalidation.

infra 20 shipped

Linux Aug 5

KERNEL FIXES INTEGER UNDERFLOW IN IMA, VHOST/VDPA PULLS CRITICAL PATCHES

Linux mainline absorbed a batch of urgent fixes overnight: an integer underflow in IMA's xattr verification that could trigger out-of-bounds reads, plus critical vhost-scsi and futex race condition patches.

infra 20 shipped

Linux Aug 4

FSVERITY REGRESSION FIXED, CGROUP TIMER BUG PATCHED, OMARCHY SHELL RESTART UNCONDITIONAL

Linus pulled three critical filesystem and scheduler fixes overnight while Omarchy shipped a shell restart mandate that kills stale QML loading.

infra 20 shipped

Elsewhere on the wire

AI Agents Aug 8

LANGCHAIN PATCHES CLAUDE FILE TOOLS AND OPENAI CONTEXT ERRORS

LangChain shipped langchain-openai 1.4.2 with fixes for context window overflows and broken Claude rename operations, while OpenHands v1.11.0 adds per-run LLM cost tracking.

ai-agents 99 shipped

Local LLMs Aug 8

OLLAMA SHIPS BLOCK-DIFFUSION SPECULATIVE DECODING, SGLANG LAUNCHES KIMI K3 DAY-0

Draft models just got faster: Ollama merged DFlash block-diffusion speculative decoding that proposes entire token sequences in one forward pass, while SGLang shipped production-ready support for Kimi K3, a 2.8T-parameter multimodal LatentMoE that routes through a latent space with 896 experts.

+12

llms 263 shipped

@CachyOS Aug 8

CACHYOS AUTOMATION PUSHES BROWSER UPDATES ACROSS THE STACK

Five browser and utility packages shipped overnight with automated version bumps, while the Welcome interface gains Traditional Chinese support and translation cleanup hits the queue.

infra 51 shipped

Elixir & Phoenix Aug 8

ELIXIR PARSER GETS LEANER AS PHOENIX AUDITS DEAD CODE

Daniel Kukula shipped three consecutive optimizations to Elixir's date parsing pipeline, removing accumulators and intermediate allocations in a focused performance push [ref:1] [ref:2] [ref:3].