RepoJournal

$ cat linux/week/2026-08-24.log

Linux

Linux

the week in review · Aug 24 – Aug 30, 2026

Omarchy closes root-escalation paths as the 7.3 merge window churns

♥

Omarchy spent the week hardening its CLI and Docker story against root escalation, while Linux 7.3 merge activity landed fixes across filesystems, RCU, and SCSI.

221 commits 57 PRs merged 1 releases 7 briefings covered
linux wire → next week →

Omarchy closed two remote code execution and two root-escalation paths this week. A video title could reach notify-send such that it was parsed as an option, and similarly a crafted title could become the Download Video play command; both now treat untrusted text as data, not arguments [1] [2]. Separately, the click-action runner was reworked so argv-style click actions execute through a login shell as positional parameters, and the old --exec form that accepted trailing command words was removed entirely; --exec-arg is now the only click-command form [3] [4] [5]. The sudo lockout reset command was removed [6], and two passwordless root-escalation paths in CUPS and browser policy were closed . Together these mean the click surface no longer offers a shortcut from user input to root.

The Docker group is no longer a default. Omarchy stopped putting users in the docker group and made it opt-in, with a reboot flagged when the group changes and a menu that offers to reboot after toggling sudoless Docker [7] [8] [9]. This is a breaking change: existing installs that depended on the group are unaffected until they opt in, but fresh installs will need the explicit toggle before running Docker without sudo.

The 7.3 merge window brought a steady stream of subsystem merges into Linux: PCI, ksmbd (SMB), RCU, s390, platform-drivers-x86, dmaengine, slab, dma-mapping, and phy all merged [10] [11] [12] [13] [14] [15] [16] [17] [18]. The SCSI merge closed late in the week . The ksmbd merge in particular carries critical stability fixes for the SMB server [11].

Archinstall added guardrails around dependency churn: dev dependency updates now get a cooldown period of 3 days [19], and the linter enforces flake8-comprehensions via Ruff . The cooldown is meant to prevent a flood of automated updates from landing without review.

References

  1. [1] [Security] Stop a video title from becoming the Download Video play command (#7847) ↗ basecamp/omarchy
  2. [2] Keep relayed text out of notify-send's option parser ↗ basecamp/omarchy
  3. [3] Run argv click actions through a login shell as positional params ↗ basecamp/omarchy
  4. [4] Remove --exec entirely; --exec-arg is the only click-command form ↗ basecamp/omarchy
  5. [5] Make --exec take the command as rest-of-line words ↗ basecamp/omarchy
  6. [6] Remove the sudo lockout reset command (#8046) ↗ basecamp/omarchy
  7. [7] Don't put the user in the docker group; make it opt-in (#8056) ↗ basecamp/omarchy
  8. [8] Flag a reboot when the docker group changes (#8080) ↗ basecamp/omarchy
  9. [9] Offer to reboot when toggling sudoless Docker; show only the relevant menu entry (#8098) ↗ basecamp/omarchy
  10. [10] Merge tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci torvalds/linux
  11. [11] Merge tag 'ksmbd-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb torvalds/linux
  12. [12] Merge tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux torvalds/linux
  13. [13] Merge tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux torvalds/linux
  14. [14] Merge tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 torvalds/linux
  15. [15] Merge tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine torvalds/linux
  16. [16] Merge tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab torvalds/linux
  17. [17] Merge tags 'dma-mapping-7.3-2026-08-24' and 'dma-mapping-7.3-2026-08-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux torvalds/linux
  18. [18] Merge tag 'phy-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy torvalds/linux
  19. [19] Add a cooldown period of 3 days for dev dependency updates (#4725) ↗ archlinux/archinstall

$ ls linux/week/ # the briefings behind this review

Mon Aug 24 OMARCHY CLOSES THE RCE DOOR Tue Aug 25 OMARCHY KILLS THE ROOT EQUIVALENT DOCKER GROUP Wed Aug 26 KVM MERGE, FOUR SECURITY PATCHES: LINUX AND OMARCHY SHIP CRITICAL FIXES Thu Aug 27 NFS MERGE BRINGS CRITICAL STABILITY FIXES Fri Aug 28 CONTAINER ESCAPE FOLLOWS A SLASH Sat Aug 29 Omarchy closes two passwordless root-escalation paths in CUPS and browser policy Sun Aug 30 SCSI merge closes, Plymouth and SDDM publication hardened
linux wire → next week →