RepoJournal
Linux Linux
103 wires and counting

$ follow Linux

Keep up with Linux in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good morning, this isn't your newsletter.

One email a day. Unsubscribe in one click.

$ status

wire 2026-08-29
stories 37
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Omarchy closes two passwordless root-escalation paths in CUPS and browser policy

By RepoJournal · Filed · About Linux

Linus Torvalds Ryan Hughes mdisec acrogenesis ErikMelton bastidotnet codefiles
9 people shipped this
Linus Torvalds @torvalds 2 cited Ryan Hughes @ryanrhughes 1 cited mdisec @mdisec 1 cited acrogenesis @acrogenesis 1 cited ErikMelton @ErikMelton 1 cited bastidotnet @bastidotnet 1 cited codefiles @codefiles NWuensche @NWuensche Anouar Mohamed @AnouarMohamed

Omarchy shipped security fixes for two local privilege-escalation paths and a Qt QML auto-markup vulnerability this week.

Omarchy's default printing configuration let any desktop-session process reach root without a password: the desktop user is in `wheel`, CUPS lists `wheel` as a `SystemGroup` with `PeerCred` enabled, and the preinstall exposed two demonstrated escalation paths [1]. The fix hardens CUPS printer discovery [2]. Separate hardening changes stop world-writable Chromium policy directories, which let any local UID plant mandatory policy such as force-installed extensions; writes now go through the `omarchy-browser-policy` group at `2775` (setgid) [3]. Qt's `Text.AutoText` auto-promotes markup-looking strings to `Text.RichText`, which fetches remote images, so any `Text` under `shell/` rendering external input (notifications, MPRIS titles) could issue unauthenticated outbound GETs without user interaction; now all `Text` elements require a `textFormat` declaration [4]. The Apple-display brightness cache now validates the cached path as a real hiddev node before handing it to `asdcontrol`, instead of trusting any existing path [5]. In the kernel, CephFS makes its long-standing "make all writes synchronous" NEARFULL behavior opt-in [6], and f2fs adds resizable tail sections with unified pinned allocation plus parallel multi-device flushes [7].

Action items

References

  1. [1] Harden CUPS printer discovery ↗ basecamp/omarchy
  2. [2] Merge pull request #8627 from mdisec/security/harden-cups-browsed ↗ basecamp/omarchy
  3. [3] Stop world-writable browser policy directories ↗ basecamp/omarchy
  4. [4] Require textFormat declaration for all Text elements ↗ basecamp/omarchy
  5. [5] Validate the cached Apple-display device path before use ↗ basecamp/omarchy
  6. [6] Merge tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client ↗ torvalds/linux
  7. [7] Merge tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs ↗ torvalds/linux
Topics: Infrastructure Full archive →

Quick answers

What shipped in Linux on August 29, 2026?
Omarchy shipped security fixes for two local privilege-escalation paths and a Qt QML auto-markup vulnerability this week. In total, 27 commits and 10 pull requests landed.
Who contributed to Linux on August 29, 2026?
9 developers shipped this update, including Linus Torvalds, Ryan Hughes, mdisec, acrogenesis, ErikMelton, bastidotnet, codefiles, and NWuensche, and 1 more.
What were the notable Linux updates?
Harden CUPS printer discovery, Merge pull request #8627 from mdisec/security/harden-cups-browsed, and Stop world-writable browser policy directories.

$ log Linux --recent

CONTAINER ESCAPE FOLLOWS A SLASH 70 shipped NFS MERGE BRINGS CRITICAL STABILITY FIXES 15 shipped KVM MERGE, FOUR SECURITY PATCHES: LINUX AND OMARCHY SHIP CRITICAL FIXES 29 shipped OMARCHY KILLS THE ROOT EQUIVALENT DOCKER GROUP 38 shipped

$ log --all # elsewhere on the wire

AI Agents Langchain ships MCP adapter, Cline fixes telemetry and CVEs Local LLMs OpenVINO backend lands Qwen3.5 on NPU, Whisper.cpp support

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.