$ cat linux/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
Omarchy 4.0.3 closes sudo and Kitty holes
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Seven security hardening merges land in one week, while Linux 7.3-rc3 ships configfs, x86, and tracing fixes.
v4.0.3 basecamp/omarchy
The release includes out-of-the-box Hermes and Openclaw integration plus additional security fixes validated by the Omarchy Security team. That team, and the credit to _SiCk // afflicted.sh for independently reproducing the passwordless sudo persistence issue, are the through-line of the week: Omarchy is shipping fixes it can name and attribute.
Fail closed when passwordless sudo expiry cannot arm basecamp/omarchy
Passwordless sudo expiry now fails closed instead of leaving an unrestricted grant live when systemd-run cannot arm. The boot cleanup from the earlier proposal is kept, and the fail-open path is closed.
Move Kitty defaults to the system config and restrict remote control basecamp/omarchy
Omarchy moves its Kitty defaults to /etc/xdg/kitty/kitty.conf and switches to socket-only remote control, so untrusted terminal output can no longer issue remote-control commands as the user. Only the local Unix socket used for active-tab directory tracking remains.
Harden ownership of installed sleep hooks basecamp/omarchy
Keyboard-backlight and hybrid-GPU sleep hooks, plus the supergfxd service drop-in, now install through hidden root-owned staging inodes. Existing unsafe ownership is repaired on upgrade.
Merge pull request #9618 from acrogenesis/security/plugin-auth-boundary basecamp/omarchy
Third-party plugins lose access to authentication services, a boundary change that may break plugins relying on the old path.
Install broadcom-wl-dkms now that Arch dropped the prebuilt module basecamp/omarchy
Arch dropped the prebuilt broadcom-wl package on 2026-09-02 and rebuilt broadcom-wl-dkms with replaces=(broadcom-wl). Because replaces only helps upgrades of an already-installed package, Omarchy now installs broadcom-wl-dkms directly.
Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux torvalds/linux
A symlink racing with rmdir of its target could reach a freed ->ci_dentry, and configfs_get_config_item() treated a hashed dentry as proof the item was live. The fixes pin the symlink target's dirent and unhash the dentry before dropping the item.
Merge tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip torvalds/linux
Fixes for older AMD device topology and machine check issues; the pull request notes these affect real users and aren't just cleanup. Alongside: tracefs reference fixes, a local_interrupt_disable() softirq delay mostly affecting the Rust runtime, and a mbigen irqchip revert for two-port Hi1616 chips.
$ ls linux/week/ # the briefings behind this review
Keep up with Linux in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.