Who contributed to Linux on August 24, 2026?

6 developers shipped this update, including Linus Torvalds, Adrian Rangel, Ryan Hughes, Claude Opus 5 (1M context), correctmost, and renovate.

What were the notable Linux updates?

[Security] Stop a video title from becoming the Download Video play command (#7847), Run argv click actions through a login shell as positional params, and Remove --exec entirely; --exec-arg is the only click-command form.

Linux

The kernel, distros, and the rigs of the moment

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

OMARCHY CLOSES THE RCE DOOR

By RepoJournal · Filed 06:57 UTC on August 24, 2026 · About Linux

6 people shipped this

Linus Torvalds @torvalds 4 cited

Ryan Hughes @ryanrhughes 3 cited

Adrian Rangel @acrogenesis 1 cited

Claude Opus 5 (1M context) @claude 1 cited

correctmost @correctmost 1 cited

renovate @renovate

A hard-won hardening sweep in omarchy kills the last free-form shell execution paths, and the kernel's merge storm delivers PCI, RCU, and SMB2 upgrades.

Omarchy locked down its click-command surface after a string of related fixes: a supply-chain style injection that let a video title become the download command is closed by printing only the real file and invoking mpv with -- [1], and the argv path now runs through a login shell as positional parameters [2]. The team then removed --exec entirely, pointing callers at the argv form, and dropped the omarchy-exec string hint to prevent re-introducing an RCE [3]. A new ergonomic --exec consumes the rest of the line as words, never splitting a string itself [4], but the same class of attack is still possible through notify-send's option parser if relayed text begins with a dash [5]. Meanwhile, the kernel merged PCI updates that fix hotplug reservation growth [6], RCU work that makes expedited grace periods expedite normal callbacks [7], and SMB server updates focused on SMB2 command sequencing, SMB3 replay, encryption, and SMB Direct transport [8]. s390 adds a cpuidle driver for better sleep/wakeup latency [9], and archinstall added a 3-day cooldown for dependency updates to slow supply chain attacks [10].

Action items

→ Update omarchy and verify click-command configs use --exec or --exec-arg, not removed flags basecamp/omarchy [immediate]
→ Review notify-send callers in omarchy for relayed text that could be parsed as flags basecamp/omarchy [immediate]
→ Test PCI hotplug and RCU behavior with 7.3-rc1 torvalds/linux [plan]
→ Monitor archinstall dependency cooldown for impact on supply chain risk archlinux/archinstall [monitor]

References

[1] [Security] Stop a video title from becoming the Download Video play command (#7847) basecamp/omarchy
[2] Run argv click actions through a login shell as positional params basecamp/omarchy
[3] Remove --exec entirely; --exec-arg is the only click-command form basecamp/omarchy
[4] Make --exec take the command as rest-of-line words basecamp/omarchy
[5] Keep relayed text out of notify-send's option parser basecamp/omarchy
[6] Merge tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci torvalds/linux
[7] Merge tag 'ksmbd-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb torvalds/linux
[8] Merge tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux torvalds/linux
[9] Merge tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux torvalds/linux
[10] Add a cooldown period of 3 days for dev dependency updates (#4725) archlinux/archinstall

Quick answers

What shipped in Linux on August 24, 2026?: A hard-won hardening sweep in omarchy kills the last free-form shell execution paths, and the kernel's merge storm delivers PCI, RCU, and SMB2 upgrades. In total, 35 commits and 10 pull requests landed.
Who contributed to Linux on August 24, 2026?: 6 developers shipped this update, including Linus Torvalds, Adrian Rangel, Ryan Hughes, Claude Opus 5 (1M context), correctmost, and renovate.
What were the notable Linux updates?: [Security] Stop a video title from becoming the Download Video play command (#7847), Run argv click actions through a login shell as positional params, and Remove --exec entirely; --exec-arg is the only click-command form.

KERNEL URGENT FIXES LAND AS PERF TOOLS GAIN FUNCTION VIEW

Linus shipped a batch of urgent scheduler and futex fixes overnight while perf c2c picked up a long-awaited function view.

infra 23 shipped

Linux Aug 22

LINUX 7.3 MERGE WINDOW OPENS WITH RUST MODULE SUPPORT

Linus Torvalds pulled in the first wave of 7.3 merge requests overnight, and the headline is Rust now has a foothold in kernel module parameters.

infra 13 shipped

Linux Aug 21

LINUX 7.3 MERGE WINDOW OPENS WITH BPF VERIFIER OVERHAUL

Linus pulled the biggest networking and BPF updates of the cycle overnight, and the verifier just got a whole lot easier to debug.

infra 44 shipped

Linux Aug 20

LINUX MERGES INTEGRITY, SMACK, AND CHROME PLATFORM FIXES

The kernel's latest release pulled in critical security fixes and platform updates that you need to know about before your next build.

infra 67 shipped

Elsewhere on the wire

AI Agents Aug 24

CLINE SHIPS V4.1.15 AS TELEMETRY BUGS SURFACE ACROSS THE AGENT STACK

Cline's long-awaited auto-approve fix landed overnight, but it's the telemetry drop in 4.1.11 that should have you checking your session metrics.

ai-agents 44 shipped

Local LLMs Aug 24

VLLM'S P2P WEIGHT SYNC CUTS RL MOE TRANSFER COSTS

Forget all-gathering experts during RL rollout: vLLM's new sharded_rdt backend lets each worker pull only the slice it needs, turning a total_bytes transfer into a total_bytes divided by num_workers one.