$ cat linux/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
Omarchy polkit PAM stack skipped system-auth
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The flaw, reported privately to security@omarchy.org, dropped pam_faillock from fingerprint and FIDO2 polkit logins.
Defer to system-auth in the polkit stack written by fingerprint/FIDO2 setup basecamp/omarchy
Machines set up with `omarchy setup security fingerprint` or `omarchy setup security fido2` get an /etc/pam.d/polkit-1 that does not defer to system-auth, which drops pam_faillock out of the polkit stack. If it was your setup that wrote that file, check whether lockout rules still apply to polkit prompts.
Fix fingerprint enrollment and lock-screen recovery (#7158) basecamp/omarchy
A fingerprint verify still open when the machine suspends leaves fprintd unable to hand the reader back: the verify dies with "Cannot run while suspended" and the follow-up fails too. Suspending mid-verify also broke lock-screen recovery, so the fix restarts fprintd after resume to clear the wedged claim.
Retry systemd reload in the fingerprint recovery migration (#14260) basecamp/omarchy
A failed systemd reload left the fingerprint recovery migration pending even though the drop-in was already installed. The retry now reloads existing configuration, so migration completion actually means systemd has applied the stop directive.
Prevent clipboard capture hangs (#9488) basecamp/omarchy
In watch mode capture.sh read the copy from the owner's pipe on stdin to EOF with no bound, so a stalled owner silently killed clipboard history. Reads are now bounded, and copies cut off at the deadline are dropped rather than stored truncated.
Merge tag 'cgroup-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup torvalds/linux
During CPU offline the active mask drops the CPU before cpuset updates the effective CPUs, and a task placement in that window could find no active CPU. Related cpuset work also moved an is_in_v2_mode() check inside the cpuset_mutex critical section to close a reported TOCTOU race with cgroup hierarchy changes.
Merge tag 'sched_ext-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext torvalds/linux
Taking a CPU offline could hang, or stall until the watchdog ejected the BPF scheduler, when tasks on the dying CPU were still held by the scheduler. Fixes landed in the 7.3-rc6 window.
Merge tag 'urgent.2026.10.01a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux torvalds/linux
The fix removes a spurious WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct(), a regression introduced by the commit that queues sdp->work when the delay timer is successful, according to the pull request.
Merge tag 'selinux-pr-20261005' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux torvalds/linux
Alongside: SECURITY_LSM_NATIVE_LABELS is now preserved when superblocks are reused, dm-integrity validates its superblock after re-reading it and stops a buffer overflow when tag size exceeds 64, btrfs cleaned up command queuing in its encoded read/write ioctls, and the XPS 13 PTL speaker aliases ship through the package helper so firmware refreshes keep them.
$ ls linux/week/ # the briefings behind this review
Keep up with Linux in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.