$ the-wire · showcase
TCP use-after-free fix, RDS path sizing, Omarchy stops forcing NVIDIA env on hybrids
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
Five networking fixes land in torvalds/linux, three of them reachable by unprivileged or remote input, while Omarchy corrects two long-running hardware and agent-install annoyances.
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() torvalds/linux
In tcp_send_synack(), replacing the cloned SYN skb with a copy frees the original through tcp_rtx_queue_unlink_and_free() but repairs only tp->highest_sack, leaving tp->retransmit_skb_hint pointing at a freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(), and the commit states an unpri...
af_packet: fix integer overflow in prb_calc_retire_blk_tmo() torvalds/linux
by Dairui Zhang
prb_calc_retire_blk_tmo() computes mbits in 32-bit int, and packet_set_ring() rejects only non-positive or unaligned tp_block_size, so a 256MiB block wraps 0x10000000 * 8 to INT_MIN. Treat user-set TPACKET_V3 ring sizes as untrusted on any host where unprivileged packet sockets are enabled.
net/rds: size a connection's path set by the transport it ends up with torvalds/linux
by Allison Henderson
__rds_conn_create() sizes npaths from the caller's transport before it decides that a connection to one of the host's own addresses will be handled by the loopback transport, so the init loop still allocates an ordered workqueue per RDS_MPATH_WORKERS path for a loopback connection. Any RDS/TCP socket sending to a local address is the path that hits this.
nfp: hold IPsec RX state under the XArray lock torvalds/linux
nfp_net_ipsec_rx() drops the XArray lock before taking a reference to the xfrm_state it found, and the delete path can erase the entry and drop the last reference in that window, letting RX increment a zero refcount after the state is queued for destruction. The driver queues firmware invalidation asynchronously and the delete path neither waits for the command nor drains pending RX processing.
net: phylink: record the PHY only once bringup cannot fail torvalds/linux
phylink_bringup_phy() stores the PHY in pl->phydev before its last fallible step, and phy_eee_rx_clock_stop() can fail with a real MDIO error on a MAC whose phylink ops implement LPI. Callers unwind with phy_detach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect.
Only force NVIDIA VA-API/GLX env when NVIDIA drives the display basecamp/omarchy
Forcing NVIDIA VA-API/GLX drivers globally breaks Chromium-based browsers on hybrid laptops, where the display is usually wired to the iGPU: black YouTube video with audio still playing, reproduced in both Brave and Chromium. The new omarchy-hw-nvidia-display detector reads the boot_vga sysfs flag using the same cached-sysfs style as the other omarchy-hw-nvidia* detectors, with no lspci wakeups.
Install Hermes for the default agent as the desktop app's self-updating runtime basecamp/omarchy
Choosing Hermes under Setup > Default Agent built it through mise, and hermes update fast-forwards a git checkout that a pipx environment does not have, so that copy could never update itself. A machine that picked Hermes from the agent menu now gets the same self-updating runtime that Install > AI > Hermes Desktop set up under ~/.hermes. The removal path followed suit, with Remove > AI now sto...
