RepoJournal
Linux Linux
152 wires and counting

$ follow Linux

Keep up with Linux in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-24
stories 45
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

OMARCHY CLOSES THE RCE DOOR

By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology

Linus Torvalds Ryan Hughes Adrian Rangel Claude Opus 5 (1M context) correctmost renovate
6 people shipped this
Linus Torvalds @torvalds 4 cited Ryan Hughes @ryanrhughes 3 cited Adrian Rangel @acrogenesis 1 cited Claude Opus 5 (1M context) @claude 1 cited correctmost @correctmost 1 cited renovate @renovate

A hard-won hardening sweep in omarchy kills the last free-form shell execution paths, and the kernel's merge storm delivers PCI, RCU, and SMB2 upgrades.

Omarchy locked down its click-command surface after a string of related fixes: a supply-chain style injection that let a video title become the download command is closed by printing only the real file and invoking mpv with -- [1], and the argv path now runs through a login shell as positional parameters [2]. The team then removed --exec entirely, pointing callers at the argv form, and dropped the omarchy-exec string hint to prevent re-introducing an RCE [3]. A new ergonomic --exec consumes the rest of the line as words, never splitting a string itself [4], but the same class of attack is still possible through notify-send's option parser if relayed text begins with a dash [5]. Meanwhile, the kernel merged PCI updates that fix hotplug reservation growth [6], RCU work that makes expedited grace periods expedite normal callbacks [7], and SMB server updates focused on SMB2 command sequencing, SMB3 replay, encryption, and SMB Direct transport [8]. s390 adds a cpuidle driver for better sleep/wakeup latency [9], and archinstall added a 3-day cooldown for dependency updates to slow supply chain attacks [10].

Action items

References

  1. [1] [Security] Stop a video title from becoming the Download Video play command (#7847) ↗ basecamp/omarchy
  2. [2] Run argv click actions through a login shell as positional params ↗ basecamp/omarchy
  3. [3] Remove --exec entirely; --exec-arg is the only click-command form ↗ basecamp/omarchy
  4. [4] Make --exec take the command as rest-of-line words ↗ basecamp/omarchy
  5. [5] Keep relayed text out of notify-send's option parser ↗ basecamp/omarchy
  6. [6] Merge tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci torvalds/linux ↗
  7. [7] Merge tag 'ksmbd-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb torvalds/linux ↗
  8. [8] Merge tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux torvalds/linux ↗
  9. [9] Merge tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux torvalds/linux ↗
  10. [10] Add a cooldown period of 3 days for dev dependency updates (#4725) ↗ archlinux/archinstall

$ ls linux/reviews/ # the step-back reads

the week in review Omarchy polkit PAM stack skipped system-auth the month in review Linux 7.3 rc cycle fixes cgroup kill, SMB corruption
Full archive → Weekly reviews →

Quick answers

What shipped in Linux on August 24, 2026?
A hard-won hardening sweep in omarchy kills the last free-form shell execution paths, and the kernel's merge storm delivers PCI, RCU, and SMB2 upgrades. In total, 35 commits and 10 pull requests landed.
Who contributed to Linux on August 24, 2026?
6 developers shipped this update, including Linus Torvalds, Adrian Rangel, Ryan Hughes, Claude Opus 5 (1M context), correctmost, and renovate.
What were the notable Linux updates?
[Security] Stop a video title from becoming the Download Video play command (#7847), Run argv click actions through a login shell as positional params, and Remove --exec entirely; --exec-arg is the only click-command form.
♥

$ log Linux --recent

drm-fixes backs out dma-buf debug, vfs closes pathwalk use-after-frees 29 shipped Netlink stops hashing the net pointer, stmmac clears a stuck RGMII interrupt 27 shipped Poly1305 carry fix lands, Omarchy locks down N1x laptops and idle fingerprint readers 23 shipped Omarchy copies agent logins over SSH, kernel queues 7.4 merges 106 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.