The Wire · Showcase
KVM MERGE, FOUR SECURITY PATCHES: LINUX AND OMARCHY SHIP CRITICAL FIXES
By RepoJournal · Filed · About Linux
Linux merges KVM and peripheral updates while Omarchy closes four security holes that let attackers execute Lua, control root SSH, and hijack FIDO2 auth.
Linus pulled in the KVM merge tag [1] with 'slot' based PMU events and lazy save/restore for pKVM, plus a host of remoteproc additions including an AMD MicroBlaze/V driver and a generic Qualcomm PAS service [2]. Greg KH's USB and Thunderbolt update for 7.3-rc1 brings new device support [3], while the staging tree is mostly churn [4]; the char-misc merge adds IIO and binder work [5]. Over on Omarchy, a security patch stops USB device names from being executed as Hyprland Lua [6], another prevents the FIDO2 setup from staging its authfile at a predictable /tmp path [7], and a third constrains the tzupdate sudoers rule to a single argument to block root SSH attacks [8]. The git URL check is now shared and refusals apply to unsupported transports [9]. Finally, Dell XPS 13 sidecar speaker amplifiers can be enabled [10].
One email a day. Unsubscribe in one click.
Keep up with Linux in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Upgrade Omarchy and apply all four security patches immediately basecamp/omarchy [immediate]
- → Review your Linux kernel config for KVM PMU changes torvalds/linux [plan]
- → Monitor the char-misc binder and IIO updates torvalds/linux [monitor]
References
- [1] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm torvalds/linux
- [2] Merge tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux torvalds/linux
- [3] Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb torvalds/linux
- [4] Merge tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging torvalds/linux
- [5] Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc torvalds/linux
- [6] [Security] Stop USB device names from being executed as Hyprland Lua (#8129) basecamp/omarchy
- [7] [Security] Stop the FIDO2 setup staging its authfile at a predictable /tmp path (#7904) basecamp/omarchy
- [8] Constrain the tzupdate sudoers rule to a single timezone argument (#8194) basecamp/omarchy
- [9] Share the git URL check, and refuse the transports Omarchy does not clone from (#8174) basecamp/omarchy
- [10] Enable Dell XPS 13 sidecar speaker amplifiers (#7032) basecamp/omarchy