Security1 publisher2 min readPublished Updated
GDM accepts passkeys and smart cards at the login screen in GNOME 51
The same release deletes the two NVIDIA-specific code paths Mutter carried for Wayland, so GeForce 700-series cards drop back to the open-source Nouveau driver. Fedora 45 and Ubuntu 26.10 both ship it.
The Watch · Security desk
What happened
- GNOME 51 came out on September 16 under the codename A Coruña, and Fedora 45 and Ubuntu 26.10 will both ship it.
- GDM, the login screen, now offers smart card, passkey and QR code login, and Remote Desktop adds smartcard passthrough and Kerberos.
- Mutter developer Jonas Ådahl removed the code behind NVIDIA's legacy Wayland support during the GNOME 51 cycle.
- UbuntuHandbook lists the GeForce 700 series and older as losing the proprietary driver on GNOME, apart from the GTX 750 Ti, GTX 750 and GTX 745, with the rest falling back to Nouveau in a basic mode.
- Papers, the document viewer, can now place a hand-drawn or imported signature image onto a PDF page.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision A fleet with 700-series NVIDIA hardware has to settle one question before either distribution upgrade lands: accept Nouveau's basic mode on those desktops, or hold them back, or replace the cards.
- capability Sites that already issue smart cards or FIDO credentials can present them at the console itself, and the Kerberos and smartcard passthrough work carries the same credential into Remote Desktop sessions.
- exposure A document workflow that accepts a Papers signature as evidence of assent has no way to tell the signer's mark from a recipient's, so verification has to happen outside the PDF.
Mutter is GNOME's compositor, the program that assembles windows into what appears on screen [17]. It had carried two NVIDIA-specific paths: EGLStreams, which applications used to draw on Wayland, and EGLDevice paired with EGLStream, which Mutter used to drive screen updates [9]. No other GPU vendor adopted EGLStreams, which NVIDIA had built as its own route to Wayland [10]. NVIDIA later added support for GBM, the buffer-allocation method the Intel and AMD drivers use, and the old path ended up serving only legacy drivers [11].
In the commit removing it, Ådahl wrote that the old approach had long been "replaced with the standard DMA buffer passing protocol in Wayland" [12]. Cards on NVIDIA's current drivers already use GBM and should see no change [13]. The machines that change behaviour are the ones on a driver branch old enough to need the deleted path, and the coverage does not list which branches those are, so the card model is the test [14].
The example given in the release coverage, a GeForce GTX 780, sits inside UbuntuHandbook's affected set: it is a 700-series card and not one of the three exceptions [6][1]. The check before either distribution upgrade runs per machine. Which desktops still hold a 700-series or older GeForce, and which of those have the proprietary driver installed.
On the sign-in side, the release notes describe the Kerberos work as useful to organizations whose sign-in already runs through Kerberos [4]. Remote Login now supports SSH socket servers, and fingerprint enrollment in Settings has a new interface [5].
Papers builds its signature by having the user draw with a mouse or touchscreen, or import an image whose background is removed automatically [15]. What lands on the page is a picture. Nothing in it identifies the signer or detects a later edit, and anyone holding the PDF can draw one [16].
What to watch
- Bug reports from 700-series users once Fedora 45 and Ubuntu 26.10 reach general availability, which will show what Nouveau's basic mode costs on real desktops.
- Whether either distribution offers a supported path for affected machines to stay on the previous GNOME release.
- Whether GDM's passkey support gains managed enrollment for fleets rather than per-user setup.