Who contributed to Linux on August 28, 2026?

9 developers shipped this update, including Linus Torvalds, Lorenzo Bianconi, Pablo Neira Ayuso, Chessing234, omarchybot, Claude, codefiles, and correctmost, and 1 more.

What were the notable Linux updates?

Keep a web app name out of the launcher's directory structure, Prove the web app name guard, and reject before the icon is fetched, and Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.

Aug 28, 2026

$ the-wire · showcase

CONTAINER ESCAPE FOLLOWS A SLASH

By RepoJournal · Filed 06:57 UTC on August 28, 2026 · About Linux

9 people shipped this

Linus Torvalds @torvalds 1 cited

Lorenzo Bianconi @LorenzoBianconi 1 cited

Pablo Neira Ayuso @ummakynes 1 cited

Chessing234 @Chessing234 1 cited

Claude @dhh 1 cited

codefiles @codefiles 1 cited

correctmost @correctmost 1 cited

omarchybot @omarchybot

renovate @renovate

A typo in a web app name creates an unremovable launcher entry and a launcher directory escape in omarchy, while the kernel's rmap indexing gets a critical fix.

Omarchy's web app installer lets a slash in a Name field write into a path like `~/.local/share/applications/http:/127.0.0.1:4000/.desktop`, making the launcher impossible to remove and opening a directory traversal hole [1]. The follow-up merge and the guard test prove the fix, but only after `../../../../escape` paths were closed [2]. On the kernel side, Lorenzo Stoakes's rmap patch indexes MAP_PRIVATE file-backed folios by anonymous pgoff to eliminate reverse-mapping conflicts for CoW'd memory [3], and the stmmac driver now drops its gso_enabled_types field to stop IPv6 GSO frames falling to a non-TSO path when IPv4 TSO is disabled [4]. The MM merge also pulls in the long-awaited new index tracking [3], while the netfilter cleanup removes a leftover on-stack set_update_list [5]. Smaller housekeeping lands in archinstall: the Ruff mutable-argument-default rule is enabled and Pylint's dangerous-default-value exclusion is removed [6][7].

Action items

→ Update omarchy and reject web app names containing '/' before fetching icons basecamp/omarchy [immediate]
→ Test your IPv6 GSO workloads on stmmac hardware and pull the net fix torvalds/linux [plan]
→ Merge the MM rmap indexing fix if you rely on MAP_PRIVATE CoW behavior torvalds/linux [plan]
→ Monitor the archinstall lint changes for any mutable defaults regressions archlinux/archinstall [monitor]

References

[1] Keep a web app name out of the launcher's directory structure ↗ basecamp/omarchy
[2] Prove the web app name guard, and reject before the icon is fetched basecamp/omarchy
[3] Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm torvalds/linux
[4] net: stmmac: drop gso_enabled_types and rely on netdev features torvalds/linux
[5] netfilter: nf_tables: remove leftover set_update_list torvalds/linux
[6] Enable Ruff mutable-argument-default rule ↗ archlinux/archinstall
[7] Remove the Pylint dangerous-default-value exclusion (#4733) archlinux/archinstall