Review Results

Comment

The change only updates the SHA-256 checksum for one declared source artifact in PKGBUILD. There are no new sources, no build-script logic changes, no network-fetch behavior changes, and no packaging/install-time execution paths introduced by this diff. On its face this is a routine integrity update, though the security significance depends on whether the new checksum corresponds to the expected upstream source; nothing in the diff itself suggests tampering or a supply-chain risk.

@@ -57,7 +57,7 @@ validpgpkeys=(
   83BC8889351B5DEBBB68416EB8AC08600F108CDF  # Jan Alexander Steffens (heftig)
 )
 sha256sums=('91e4df83d2049987d063d2fde93e12b65e50a463c11811f77dc72ed03abe7fd9'
-            '9f6e1be50d2ebb69a23b14799ccf23462c80e29f284ce3b205186921c5c3bf3d')
+            'e8f340e4d83dd3cac6ac516a6d43919d325ec15895c8e63bb27e1db156eb0731')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=$pkgbase

Comment

The only change in this hunk is the autogenerated kernel config banner version string, from 7.2.2-arch1 to 7.2.14-arch1. No build logic, sources, scripts, permissions, or runtime behavior are affected. This is a metadata-only update with no security impact visible in the provided diff.

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.2.2-arch1 Kernel Configuration
+# Linux/x86 7.2.14-arch1 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260810"
 CONFIG_CC_IS_GCC=y

Comment

The change only bumps kernel config version metadata for Rust toolchain compatibility (rustc and rustc-LLVM version numbers). It does not alter build scripts, sources, install hooks, permissions, or introduce any executable code or network-fetching behavior. No security-relevant impact is evident from this diff alone.

@@ -11,10 +11,10 @@ CONFIG_AS_VERSION=24700
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=24700
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=109800
+CONFIG_RUSTC_VERSION=109901
 CONFIG_RUST_IS_AVAILABLE=y
-CONFIG_RUSTC_LLVM_VERSION=220108
-CONFIG_RUSTC_LLVM_MAJOR_VERSION=22
+CONFIG_RUSTC_LLVM_VERSION=230103
+CONFIG_RUSTC_LLVM_MAJOR_VERSION=23
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
 CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y

Comment

The change only adjusts kernel build configuration values: it adds CONFIG_CC_OPT_INLINE_MEMSET="-finline-stringops=memset" and bumps CONFIG_PAHOLE_VERSION from 131 to 132. This does not introduce any new code execution paths, network access, privilege changes, or packaging/install-script behavior. It is a normal build-configuration update for the kernel toolchain and debug info tooling, with no obvious security impact in the reviewed hunk.

@@ -25,13 +25,14 @@ CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_CC_HAS_COUNTED_BY=y
 CONFIG_CC_HAS_COUNTED_BY_PTR=y
 CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
+CONFIG_CC_OPT_INLINE_MEMSET="-finline-stringops=memset"
 CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
 CONFIG_RUSTC_HAS_SPAN_FILE=y
 CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y
 CONFIG_RUSTC_HAS_FILE_WITH_NUL=y
 CONFIG_RUSTC_HAS_FILE_AS_C_STR=y
 CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS=y
-CONFIG_PAHOLE_VERSION=131
+CONFIG_PAHOLE_VERSION=132
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_TABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y

Comment

The change only updates embedded kernel build metadata in config.x86_64: the recorded rustc and bindgen version strings. There is no executable logic, no source URL change, no build-script/network behavior, and no packaging/persistence impact visible in this hunk. On its face this is a low-risk, informational config update.

@@ -345,8 +346,8 @@ CONFIG_PERF_EVENTS=y
 CONFIG_SYSTEM_DATA_VERIFICATION=y
 CONFIG_PROFILING=y
 CONFIG_RUST=y
-CONFIG_RUSTC_VERSION_TEXT="rustc 1.98.0 (88d9e12ae 2026-08-18) (Arch Linux rust 1:1.98.0-1)"
-CONFIG_BINDGEN_VERSION_TEXT="bindgen 0.72.1"
+CONFIG_RUSTC_VERSION_TEXT="rustc 1.99.1 (58cf8f9c3 2026-10-13) (Arch Linux rust 1:1.99.1-1)"
+CONFIG_BINDGEN_VERSION_TEXT="bindgen 0.73.2"
 CONFIG_TRACEPOINTS=y
 
 #

Comment

The change only adds a kernel config symbol, CONFIG_RUSTC_HAS_APXF=y, to the shipped x86_64 config. This is a build-time configuration toggle, not an executable script, source URL, patch, or install hook. There is no evidence here of network access, privilege escalation, persistence, or other supply-chain risk in the diff hunk itself. Based on the provided change alone, it appears low risk.

@@ -450,6 +451,7 @@ CONFIG_ACRN_GUEST=y
 CONFIG_BHYVE_GUEST=y
 CONFIG_INTEL_TDX_GUEST=y
 CONFIG_CC_HAS_MARCH_NATIVE=y
+CONFIG_RUSTC_HAS_APXF=y
 # CONFIG_X86_NATIVE_CPU is not set
 CONFIG_X86_INTERNODE_CACHE_SHIFT=6
 CONFIG_X86_L1_CACHE_SHIFT=6

Comment

This change only disables CONFIG_MEDIA_SUBDRV_AUTOSELECT in the kernel config. That reduces automatic selection of media subdrivers and does not introduce any new code execution, network access, privilege escalation, or packaging integrity concerns. It is a functional kernel configuration change, not a security-sensitive build/install script modification.

@@ -6259,7 +6261,7 @@ CONFIG_USB_RAINSHADOW_CEC=m
 
 CONFIG_MEDIA_SUPPORT=m
 CONFIG_MEDIA_SUPPORT_FILTER=y
-CONFIG_MEDIA_SUBDRV_AUTOSELECT=y
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
 
 #
 # Media device types

Comment

The change only removes CONFIG_MEDIA_HIDE_ANCILLARY_SUBDRV and the associated comment block from the kernel config, while leaving the actual ancillary driver selection (e.g. CONFIG_VIDEO_IR_I2C=m) intact. This does not introduce new code, network access, privilege changes, or packaging/install-time behavior. It is a low-risk configuration tweak with no obvious security impact in the reviewed hunk.

@@ -6727,16 +6729,10 @@ CONFIG_VIDEOBUF2_DMA_SG=m
 CONFIG_VIDEOBUF2_DVB=m
 # end of Media drivers
 
-CONFIG_MEDIA_HIDE_ANCILLARY_SUBDRV=y
-
 #
 # Media ancillary drivers
 #
 CONFIG_MEDIA_ATTACH=y
-
-#
-# IR I2C driver auto-selected by 'Autoselect ancillary drivers'
-#
 CONFIG_VIDEO_IR_I2C=m
 CONFIG_VIDEO_CAMERA_SENSOR=y
 CONFIG_VIDEO_APTINA_PLL=m

Comment

The change only enables additional Linux kernel media/V4L2 driver options in the shipped kernel config. I do not see any supply-chain, persistence, privilege-escalation, or build-time execution risk in this hunk: it does not add scripts, network fetches, install hooks, or packaging logic, and the new symbols are standard kernel modules/CEC helpers. The main effect is broader hardware support and a larger kernel attack surface at runtime, but that is expected for a kernel config and not a packaging compromise in itself.

@@ -6844,39 +6840,113 @@ CONFIG_VIDEO_LM3646=m
 # end of Flash devices
 
 #
-# audio, video and radio I2C drivers auto-selected by 'Autoselect ancillary drivers'
+# Audio decoders, processors and mixers
 #
 CONFIG_VIDEO_CS3308=m
 CONFIG_VIDEO_CS5345=m
 CONFIG_VIDEO_CS53L32A=m
 CONFIG_VIDEO_MSP3400=m
 CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TDA1997X=m
 CONFIG_VIDEO_TDA7432=m
 CONFIG_VIDEO_TDA9840=m
 CONFIG_VIDEO_TEA6415C=m
 CONFIG_VIDEO_TEA6420=m
+CONFIG_VIDEO_TLV320AIC23B=m
 CONFIG_VIDEO_TVAUDIO=m
 CONFIG_VIDEO_UDA1342=m
 CONFIG_VIDEO_VP27SMPX=m
 CONFIG_VIDEO_WM8739=m
 CONFIG_VIDEO_WM8775=m
+# end of Audio decoders, processors and mixers
+
+#
+# RDS decoders
+#
 CONFIG_VIDEO_SAA6588=m
+# end of RDS decoders
+
+#
+# Video decoders
+#
+CONFIG_VIDEO_ADV7180=m
+CONFIG_VIDEO_ADV7183=m
+CONFIG_VIDEO_ADV7604=m
+CONFIG_VIDEO_ADV7604_CEC=y
+CONFIG_VIDEO_ADV7842=m
+CONFIG_VIDEO_ADV7842_CEC=y
+CONFIG_VIDEO_BT819=m
+CONFIG_VIDEO_BT856=m
+CONFIG_VIDEO_BT866=m
+CONFIG_VIDEO_ISL7998X=m
+CONFIG_VIDEO_LT6911UXE=m
+CONFIG_VIDEO_KS0127=m
+CONFIG_VIDEO_MAX9286=m
+CONFIG_VIDEO_ML86V7667=m
+CONFIG_VIDEO_SAA7110=m
 CONFIG_VIDEO_SAA711X=m
+CONFIG_VIDEO_TC358743=m
+CONFIG_VIDEO_TC358743_CEC=y
+CONFIG_VIDEO_TC358746=m
+CONFIG_VIDEO_TVP514X=m
 CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TVP7002=m
 CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9900=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_TW9910=m
+CONFIG_VIDEO_VPX3220=m
 
 #
 # Video and audio decoders
 #
 CONFIG_VIDEO_SAA717X=m
 CONFIG_VIDEO_CX25840=m
+# end of Video decoders
+
+#
+# Video encoders
+#
+CONFIG_VIDEO_ADV7170=m
+CONFIG_VIDEO_ADV7175=m
+CONFIG_VIDEO_ADV7343=m
+CONFIG_VIDEO_ADV7393=m
+CONFIG_VIDEO_ADV7511=m
+CONFIG_VIDEO_ADV7511_CEC=y
+CONFIG_VIDEO_AK881X=m
 CONFIG_VIDEO_SAA7127=m
+CONFIG_VIDEO_SAA7185=m
+CONFIG_VIDEO_THS8200=m
+# end of Video encoders
+
+#
+# Video improvement chips
+#
 CONFIG_VIDEO_UPD64031A=m
 CONFIG_VIDEO_UPD64083=m
+# end of Video improvement chips
+
+#
+# Audio/Video compression chips
+#
 CONFIG_VIDEO_SAA6752HS=m
+# end of Audio/Video compression chips
+
+#
+# SDR tuner chips
+#
+# end of SDR tuner chips
+
+#
+# Miscellaneous helper chips
+#
+CONFIG_VIDEO_INTEL_CVS=m
+CONFIG_VIDEO_I2C=m
 CONFIG_VIDEO_M52790=m
+CONFIG_VIDEO_ST_MIPID02=m
+CONFIG_VIDEO_THS7303=m
+# end of Miscellaneous helper chips
 
 #
 # Video serializers and deserializers

Comment

The change only removes a comment block from the kernel config file and does not alter any enabled/disabled options, build behavior, sources, or install-time actions. No security-relevant functionality is introduced or removed by this diff hunk.

@@ -6885,10 +6955,6 @@ CONFIG_VIDEO_MAX96717=m
 # end of Video serializers and deserializers
 
 #
-# SPI I2C drivers auto-selected by 'Autoselect ancillary drivers'
-#
-
-#
 # Media SPI Adapters
 #
 CONFIG_CXD2880_SPI_DRV=m

Comment

The change is a comment-only edit in the kernel config file, replacing one descriptive comment with another. It does not alter any enabled features, build behavior, sources, scripts, permissions, or runtime code paths. No security impact is evident from this diff hunk alone.

@@ -6898,7 +6964,7 @@ CONFIG_VIDEO_GS1662=m
 CONFIG_MEDIA_TUNER=m
 
 #
-# Tuner drivers auto-selected by 'Autoselect ancillary drivers'
+# Customize TV tuners
 #
 CONFIG_MEDIA_TUNER_E4000=m
 CONFIG_MEDIA_TUNER_FC0011=m

Comment

The only substantive change in the provided hunk is enabling CONFIG_MEDIA_TUNER_MSI001=m in the kernel config. This adds support for an additional media tuner driver and does not introduce any obvious supply-chain, privilege-escalation, persistence, or build-time execution risk. No scripts, patches, downloads, or packaging logic are affected by this change. Based on the diff shown, this is low risk.

@@ -6909,6 +6975,7 @@ CONFIG_MEDIA_TUNER_IT913X=m
 CONFIG_MEDIA_TUNER_M88RS6000T=m
 CONFIG_MEDIA_TUNER_MAX2165=m
 CONFIG_MEDIA_TUNER_MC44S803=m
+CONFIG_MEDIA_TUNER_MSI001=m
 CONFIG_MEDIA_TUNER_MT2060=m
 CONFIG_MEDIA_TUNER_MT2063=m
 CONFIG_MEDIA_TUNER_MT20XX=m

Comment

The change is a comment-only edit in the kernel config file, renaming/adding section labels around TV tuner and DVB frontend options. It does not alter any enabled features, source URLs, build steps, scripts, permissions, or packaging behavior. No security-relevant behavior is introduced by this diff.

@@ -6936,9 +7003,10 @@ CONFIG_MEDIA_TUNER_TUA9001=m
 CONFIG_MEDIA_TUNER_XC2028=m
 CONFIG_MEDIA_TUNER_XC4000=m
 CONFIG_MEDIA_TUNER_XC5000=m
+# end of Customize TV tuners
 
 #
-# DVB Frontend drivers auto-selected by 'Autoselect ancillary drivers'
+# Customise DVB Frontends
 #
 
 #

Comment

The change only enables the DVB_DIB9000 kernel module in the shipped kernel config. This is a normal feature toggle in a kernel package and does not introduce any new build-time downloads, scripts, privilege changes, persistence mechanisms, or suspicious packaging behavior. No security-relevant issues are evident from this diff alone.

@@ -7006,6 +7074,7 @@ CONFIG_DVB_DIB3000MB=m
 CONFIG_DVB_DIB3000MC=m
 CONFIG_DVB_DIB7000M=m
 CONFIG_DVB_DIB7000P=m
+CONFIG_DVB_DIB9000=m
 CONFIG_DVB_DRXD=m
 CONFIG_DVB_EC100=m
 CONFIG_DVB_GP8PSK_FE=m

Comment

The change only enables the upstream Linux kernel DVB_S5H1432 driver as a loadable module in the shipped kernel config. This is a normal feature toggle in a kernel package, with no evidence of added code execution, network access, privilege escalation, persistence, or packaging hygiene issues. No suspicious sources or install scripts are involved in this hunk.

@@ -7014,6 +7083,7 @@ CONFIG_DVB_MT352=m
 CONFIG_DVB_NXT6000=m
 CONFIG_DVB_RTL2830=m
 CONFIG_DVB_RTL2832=m
+CONFIG_DVB_S5H1432=m
 CONFIG_DVB_SI2168=m
 CONFIG_DVB_SP887X=m
 CONFIG_DVB_STV0367=m

Comment

The change only enables the CXD2880 DVB frontend driver as a loadable kernel module in the kernel config. This is a normal hardware-support addition with no indication of network access, privilege escalation, persistence, or packaging integrity issues. No suspicious build-time behavior or install-script impact is present in the provided diff.

@@ -7021,6 +7091,7 @@ CONFIG_DVB_TDA10048=m
 CONFIG_DVB_TDA1004X=m
 CONFIG_DVB_ZD1301_DEMOD=m
 CONFIG_DVB_ZL10353=m
+CONFIG_DVB_CXD2880=m
 
 #
 # DVB-C (cable) frontends

Comment

The change only enables an additional Linux kernel DVB frontend driver (CONFIG_DVB_MN88443X=m) in the shipped kernel config. This is a normal feature toggle in a kernel package, with no evidence of added build-time downloads, scripts, privilege changes, persistence mechanisms, or other supply-chain risk in the provided hunk. No security concerns are apparent from this diff alone.

@@ -7058,6 +7129,7 @@ CONFIG_DVB_S921=m
 #
 # ISDB-S (satellite) & ISDB-T (terrestrial) frontends
 #
+CONFIG_DVB_MN88443X=m
 CONFIG_DVB_TC90522=m
 
 #

Comment

The only change in the reviewed hunk is enabling two additional DVB frontend modules (CONFIG_DVB_LGS8GL5 and CONFIG_DVB_LNBH29). These are standard kernel driver options, built as modules, and there is no evidence of malicious behavior, privilege escalation, persistence, or build-time code execution in this diff. No install scripts, external downloads, or packaging metadata are affected by this hunk.

@@ -7080,8 +7152,10 @@ CONFIG_DVB_ISL6405=m
 CONFIG_DVB_ISL6421=m
 CONFIG_DVB_ISL6423=m
 CONFIG_DVB_IX2505V=m
+CONFIG_DVB_LGS8GL5=m
 CONFIG_DVB_LGS8GXX=m
 CONFIG_DVB_LNBH25=m
+CONFIG_DVB_LNBH29=m
 CONFIG_DVB_LNBP21=m
 CONFIG_DVB_LNBP22=m
 CONFIG_DVB_M88RS2000=m

Comment

The change is a one-line comment addition in the kernel config file: it marks the end of a DVB frontend customization section. It does not alter any kernel options, build behavior, source integrity, install scripts, or runtime behavior. No security-relevant impact is apparent from this diff.

@@ -7093,6 +7167,7 @@ CONFIG_DVB_DRX39XYJ=m
 #
 CONFIG_DVB_CXD2099=m
 CONFIG_DVB_SP2=m
+# end of Customise DVB Frontends
 
 #
 # Tools to develop new frontends

Comment

The change only increases the default dummy console dimensions from 80x25 to 160x50 in the kernel config. This affects console display size only and does not introduce code execution, privilege changes, network access, persistence, or packaging integrity issues. No security concern identified in this diff hunk.

@@ -7453,8 +7528,8 @@ CONFIG_HDMI=y
 #
 CONFIG_VGA_CONSOLE=y
 CONFIG_DUMMY_CONSOLE=y
-CONFIG_DUMMY_CONSOLE_COLUMNS=80
-CONFIG_DUMMY_CONSOLE_ROWS=25
+CONFIG_DUMMY_CONSOLE_COLUMNS=160
+CONFIG_DUMMY_CONSOLE_ROWS=50
 CONFIG_FRAMEBUFFER_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
 CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y

Comment

The change only enables CONFIG_SWIOTLB_DYNAMIC in the kernel config. This is a kernel memory-management/DMA buffering option and does not introduce any obvious supply-chain, persistence, privilege-escalation, or build-time execution risk in the package metadata or scripts. No suspicious sources, install hooks, or executable artifacts are involved in this diff hunk.

@@ -12137,7 +12212,7 @@ CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_ARCH_DMA_ADDR_T_64BIT=y
 CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED=y
 CONFIG_SWIOTLB=y
-# CONFIG_SWIOTLB_DYNAMIC is not set
+CONFIG_SWIOTLB_DYNAMIC=y
 CONFIG_DMA_NEED_SYNC=y
 CONFIG_DMA_COHERENT_POOL=y
 CONFIG_DMA_CMA=y