Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
nvidia-utils + lib32-nvidia-utils get pulled in as the default OpenGL/Vulkan provider on AMD-only systems
Reported by CRTFD-DVLPR · filed Sep 18, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
On a Framework 16 with only an AMD Radeon 840M/860M GPU (no NVIDIA hardware at all), nvidia-utils and lib32-nvidia-utils were installed as dependencies of the generic opengl-driver/vulkan-driver virtual packages pulled in by aquamarine/hyprland/libglvnd/steam — packages mesa already satisfies. pacman -Rsp nvidia-utils lib32-nvidia-utils confirms clean removal with no other package affected.
This ships a setuid-root binary (nvidia-modprobe, with a history of local privilege-escalation CVEs, e.g. CVE-2024-0126) on hardware that can never use it. Could the installer/package selection prefer mesa-only providers when no NVIDIA device is detected in lspci?
(Filed as a public issue rather than a security report since nothing here currently crosses a privilege boundary on its own — it's unnecessary attack surface, not an active exploit path.)
View raw text
On a Framework 16 with only an AMD Radeon 840M/860M GPU (no NVIDIA hardware at all), `nvidia-utils` and `lib32-nvidia-utils` were installed as dependencies of the generic opengl-driver/vulkan-driver virtual packages pulled in by aquamarine/hyprland/libglvnd/steam — packages mesa already satisfies. `pacman -Rsp nvidia-utils lib32-nvidia-utils` confirms clean removal with no other package affected. This ships a setuid-root binary (`nvidia-modprobe`, with a history of local privilege-escalation CVEs, e.g. CVE-2024-0126) on hardware that can never use it. Could the installer/package selection prefer mesa-only providers when no NVIDIA device is detected in `lspci`? (Filed as a public issue rather than a security report since nothing here currently crosses a privilege boundary on its own — it's unnecessary attack surface, not an active exploit path.)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 15:19 UTC