The GNOME Release Team has shipped GNOME 50.4 and GNOME 49.9 as stable bugfix updates, with both releases arriving on August 5, 2026. Both trains include critical security hardening for GDM, patching path traversal, autologin bypass, and denial-of-service vulnerabilities in the display manager. GNOME 50.4 adds HDR mastering display metadata support in mutter, while GLib 2.88.3 addresses CVE-2026-15588, a D-Bus pre-authentication denial-of-service flaw. Core components like Nautilus and GTK remain unchanged, as the release team describes these as deliberately conservative updates intended to improve stability without introducing new features.

GNOME Ships GNOME 50.4 and GNOME 49.9 with Critical GDM Patches

Both releases are conservative bugfix updates, though GDM security hardening and a GLib D-Bus denial-of-service fix are the real headlines.

The GNOME Release Team announced two new stable bugfix releases on August 5, 2026. GNOME 50.4 and GNOME 49.9 are now available. Distributions rolling the current or previous GNOME desktop stack should watch their repos for updates. The team called both "boring bugfix updates." That's exactly what stable maintenance should be. Safe and uneventful upgrades from earlier versions. The release train stays focused on keeping things working rather than adding flashy new features. However, the security patches in GDM are the real headline here. Multiple critical vulnerabilities got squashed in both trains.

GDM Lands Critical Security Fixes

Path traversal via SelectSession allows a compromised greeter to load arbitrary .desktop files. That could let an attacker execute commands as the authenticated user. Autologin bypass via BeginAutoLogin lets the same greeter request autologin for any local account. An attacker just needs to send arbitrary usernames. Invalid session names from the greeter crash the GDM daemon. That terminates all active sessions. Denial of service, plain and simple.

Plaintext password handling in pam_gdm wasn't great either. Cached passwords lingered in memory before freeing. Keyring buffer walks lacked bounds checking. The fix hardens input validation and ensures plaintext strings get wiped before deallocation. Not the most fun reading, but essential for anyone running GNOME on a machine with a network-accessible login screen.

GLib 2.88.3 also addresses CVE-2026-15588. It's a pre-authentication denial of service in GDBusServer. Remote attackers could crash D-Bus servers by sending excessively long authentication lines. Unbounded SASL line buffering is now capped.

GNOME 50.4: Shell, Mutter, and gvfs Updates

gnome-shell 50.4 mirrors many of the fixes landing in 49.9. Menu animation glitches are gone. Mis-scaled magnified cursor rendering on HiDPI displays is corrected. Audio popping caused by redundant volume changes has been eliminated. Search provider removal no longer takes down unrelated providers. Small improvements, but they add up.

In mutter, a new feature rounds out the changes: HDR mastering display metadata fill-in. It improves tone-mapping accuracy for HDR output. The patch also fixes blurred rendering on non-pixel-aligned monitors. Unsupported fallback monitor modes no longer get added. Invalid redraw clipping regions on rotated displays are corrected too.

gvfs 1.60.2 hardens input validation across the board. AFP, DAV, FTP, MTP, and SFTP backends all get stricter checks. Crashes in OneDrive, MTP, and SMB file backends are also resolved.

libadwaita 1.9.3 rounds out the update. Text deselection bug in AdwAboutDialog legal section is fixed. Sidebar item suffixes render correctly after arrows in page mode. False minimum-size warnings in adaptive window previews are eliminated.

GNOME 49.9: Previous Stable Train Gets Same Treatment

GNOME 49.9 brings the same GDM security patches and libadwaita polish to the older train. Distributions still on GNOME 49 should upgrade. Those on GNOME 50 should stay put.

mutter 49.7 corrects erroneous stacking order changes during workspace switches. Focus-stealing by desktop windows is de-prioritized. preferred_scale events now reach clients more reliably. Multiple crashes in window management code paths are resolved. libadwaita 1.8.7 resolves locale directory at runtime for better localization support. Touchpad scroll handling improves too. Mostly orthogonal scrolls are now ignored.

gnome-shell 49.9 includes the standard set of shell fixes: menu animations, HiDPI cursor, audio glitching, and search provider cleanup.

What's Not Changed

Core components like GTK 4, Epiphany, Nautilus, GNOME Builder, and GNOME Software did not get updates. The release is deliberately conservative. GNOME 50.4 and 49.9 are boring bugfix updates. That's a feature, not a bug. Stable trains prioritize safety over novelty.

If you need newer features in Nautilus or Epiphany, you'll have to wait for their own release cycles. The desktop stack gets the bugfixes first. Distributions rolling GNOME 50 or 49 should have these updates available within the next few days. The GNOME Release Team recommends upgrading as soon as your distro pushes the packages.

Head here to the GNOME 50.4 release notes. Head here to the GNOME 49.9 release notes.