What’s New & Improved Bazzite is now based on Fedora 45! GNOME 51.1 and KDE 6.8.2 Updated OGC kernels to 7.2.15 and 6.18.60 for NVIDIA LTS images. Mesa 26.2.6. Latest and greatest InputPlumber. Op...

What’s New & Improved Bazzite is now based on Fedora 45! GNOME 51.1 and KDE 6.8.2 Updated OGC kernels to 7.2.15 and 6.18.60 for NVIDIA LTS images. Mesa 26.2.6. Latest and greatest InputPlumber. Optional gaming networking optimization via bpftune and bpfrag services. ROCM OpenCL is now used over Mesa OpenCL on all non-nvidia images. XWaylandVideoBridge has been removed, fixing an entire class of bugs on our KDE images. Acer Predator Atlas 8 initial support: InputPlumber support, Quick Acce...

What’s New & Improved Bazzite is now based on Fedora 45! GNOME 51.1 and KDE 6.8.2 Updated OGC kernels to 7.2.15 and 6.18.60 for NVIDIA LTS images. Mesa 26.2.6. Latest and greatest InputPlumber.…

What’s New & Improved Bazzite is now based on Fedora 45! GNOME 51.1 and KDE 6.8.2 Updated OGC kernels to 7.2.15 and 6.18.60 for NVIDIA LTS images. Mesa 26.2.6. Latest and greatest InputPlumber. Optional gaming networking optimization via bpftune and bpfrag services. ROCM OpenCL is now used over Mesa OpenCL on all non-nvidia images. XWaylandVideoBridge has been removed, fixing an entire class of bugs on our KDE images. Acer Predator Atlas 8 initial support: InputPlumber support, Quick Acce...

What’s New & Improved Bazzite is now based on Fedora 45! GNOME 51.1 and KDE 6.8.2 Updated OGC kernels to 7.2.15 and 6.18.60 for NVIDIA LTS images. Mesa 26.2.6. Latest and greatest InputPlumber. Op...

Vyšla nová verze herní distribuce Bazzite 45, která je postavená na čerstvé Fedoře 45 a přináší GNOME 51.1 a KDE Plasma 6.8.2. Aktualizována jsou také linuxová jádra, grafická knihovna Mesa na verzi 26.2.6 a InputPlumber, který zajišťuje podporu ovladačů a dalších vstupních zařízení. U ne-Nvidia obrazů nově systém používá ROCm OpenCL místo Mesa OpenCL. Mezi hlavní novinky patří podpora handheldu Acer Predator Atlas 8, včetně mapování zadních tlačítek, a zařazení podpory ROG Ally X20 do stabilní verze. Bazzite nově podporuje také závodní volanty Logitech TrueForce. Na obrazech KDE řeší odstranění XWaylandVideoBridge celou skupinu dřívějších chyb. Uživatelé mohou využít také volitelnou optimalizaci síťového provozu pro hraní. Pro přípravu na chystanou podporu Easy Anti-Cheat Linux v2 přibyl příkaz ujust check-anticheat. Prověří požadavky, jako jsou Secure Boot, TPM 2.0, podepsané jádro či IOMMU, a vypíše, co případně chybí. Kontrola systém nijak nemění. Vývojáři zároveň upozorňují, že uživatelé Steam Decku nemají zapínat Secure Boot a u handheldů obecně doporučují zatím nezapínat kernel lockdown. Výrazné změny se odehrály i pod kapotou: sestavování obrazů bylo přepracováno a zrychleno. Všechny varianty se nyní obvykle sestaví přibližně za 30 minut místo dřívějších téměř 50 minut, zatímco aktualizace mohou díky změně komprese a dělení obrazů zabrat jen 100 MB. Bazzite 45 navíc zpřístupňuje údržbu Btrfs v grafickém nástroji Btrfs Assistant.

Updated for 2026: Bazzite 44's InputPlumber overhaul, Legion Go 2 SteamOS now shipping, Steam Deck OLED price hike, Legion Go S tariff volatility, and new GPD Win 5 (first Strix Halo handheld with Bazzite support).

InputPlumber is the open-source router and remapping daemon for Linux that is particularly popular among Linux gaming handhelds for combining multiple input devices and translating actions into various virtual device formats. InputPlumber supports emulating mouse, keyboard, ad gamepad inputs. With the new InputPlumber 0.79 release there is expanded hardware support and bug fixes...

InputPlumber is the open-source router and remapping daemon for Linux that is particularly popular among Linux gaming handhelds for combining multiple input devices and translating actions into…

My ideal Linux distro woulds and wouldn'ts: Would: - Have inputplumber configured ootb for a Legion Go - Have KDE Plasma and KDEP Bigscreen as the desktops - Have the codecs ootb or for download as a

Bazzite 44 vereint Desktop- und Deck-Images, setzt auf InputPlumber und erweitert AMD-HDMI-2.1-Suppo

Open source input router and remapper daemon for Linux - GitHub - ShadowBlip/InputPlumber: Open source input router and remapper daemon for Linux

InputPlumber is out with its newest feature release. As a reminder, InputPlumber is the open-source input router and remapper daemon for combining various input devices from gamepads to mice and keyboards as well as the ability to emulate them...

Critical vulnerabilities in InputPlumber, a Linux input device utility used in SteamOS, could allow attackers to inject UI inputs and cause denial-of-service conditions on affected systems. The SUSE researchers tracked as CVE-2025-66005 and CVE-2025-14338, which affect InputPlumber versions before v0.69.0 and stem from inadequate D-Bus authorization mechanisms. InputPlumber combines Linux input devices into virtual input devices and runs with full root privileges, making these flaws particularly dangerous. The vulnerabilities allow any user on the system, including low-privilege accounts, to access InputPlumber’s D-Bus service without authentication. CVE ID Issue Affected Versions Impact CVE-2025-66005 Missing authorization in D-Bus interface < v0.63.0 DoS, info leak, privilege escalation CVE-2025-14338 Polkit auth disabled + auth race condition < v0.69.0 DoS, info leak, privilege escalation Attackers Exploit this Access in Multiple Ways UI Input Injection : Malicious actors can create virtual keyboard devices and inject keystrokes into active user sessions. This could lead to arbitrary code execution in the context of the currently logged-in user, compromising their session and data. Denial-of-Service: The CreateCompositeDevice method accepts file paths from clients, allowing attackers to trigger memory exhaustion by passing special files such as /dev/zero. Information Disclosure: The same method can perform file existence tests and leak sensitive information from files normally inaccessible to low-privilege users, such as /root/.bash_history. The vulnerabilities primarily affect Linux gaming systems running InputPlumber, including SteamOS. Valve has released SteamOS 3.7.20, which includes the InputPlumber v0.69.0 fix. Upstream developers have addressed most issues by switching to proper Polkit authentication , enabling authorization by default, and applying systemd hardening. However, some D-Bus API improvements that use file descriptors instead of pathnames remain unmerged. SUSE researchers advise system administrators to immediately update to InputPlumber v0.69.0 or later, especially on gaming systems and SteamOS installations. The coordinated disclosure process between SUSE security researchers and InputPlumber developers ensured fixes were available before public disclosure. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post Critical InputPlumber Vulnerabilities Allows UI Input Injection and Denial-of-Service appeared first on Cyber Security News .

Critical flaws in InputPlumber (CVE-2025-66005) expose Linux gamers to session hijacking. Update to v0.69.0 or SteamOS 3.7.20 immediately to secure.

Posted by Matthias Gerstner on Jan 09 Hello list, please find below a report about security issues in InputPlumber [1]. We also offer a rendered HTML version of this report on our blog [2]. Summary: InputPlumber is a utility for combining Linux input devices into virtual input devices. It includes a D-Bus daemon offering an interface to all users in the system. A lack of D-Bus client authorization in versions before v0.69.0 allows arbitrary local users to inject key presses into...