senn-techSteamOS 3.9.5 is stable: Linux 7.2, Plasma 6.7, security updates
Valve released SteamOS 3.9.5 to all users on 23 October 2026. The release notes cover every change since the stable 3.8. The headlines are kernel 7.2 and Plasma 6.7.3. For admins, a line further down the list matters more: the revocation of compromised eMudhra certificates.
A note on how we label things below: what Valve writes itself is marked as a vendor claim. Our own conclusions are marked as inferences.
What Valve changes in 3.9.5
According to Valve (vendor claim, confirmed by Phoronix and GamingOnLinux), the update contains:
- a Linux kernel based on 7.2
- desktop mode moving from Plasma 6.4.3 to Plasma 6.7.3
- an updated Arch Linux base
- a bootloader with better compatibility on certain motherboards
- system packages and tools renamed from
steamos-toholo-, with aliases for the old names - reintroduced support for Android Binder IPC, plus improvements for VM guests (virtio-gpu, venus)
The jump in Plasma is big. If you have custom settings, widgets or autostart entries in desktop mode, check after the update that they still work. Valve lists no known issues for this.
Wi-Fi, power and hibernation
Valve switches the Wi-Fi backend to wpa_supplicant by default, to improve compatibility with different networks. A fast reconnect after wake-up, taken over from iwd, comes with it. Whether existing installations keep the old backend is not in the notes and stays unconfirmed.
Valve says idle power draw on the Steam Deck without audio playback has improved. There is no figure, so the effect is a pure vendor claim.
Per Valve, hibernation is only partly built in. It is not visible in the Game Mode interface and is disabled on the Steam Deck because of an open driver bug. You can neither expect it nor turn it on.
The eMudhra revocation
Under security, the notes say that compromised eMudhra CA certificates have been revoked. The background comes from a Mozilla mail on oss-security dated 20 October:
We became aware on the 17th of October that the private keys corresponding to 8 eMudhra Intermediate certificates have been compromised.
Six of the intermediates are for TLS and two for code signing. eMudhra revoked them on 18 October, Sectigo on 19 October. According to Mozilla, Firefox and Chrome are protected through OneCRL and CRLSets. Mozilla also writes that operators have to act if their clients do not check revocation information reliably or let connections through when in doubt.
BleepingComputer gives the cause: the keys were P-384 keys from April 2025 whose values were smaller than 256 because of a script bug, according to eMudhra. That means they can be recovered by trying 256 numbers. There is no evidence of abuse, although it would have been possible since April 2025. According to eMudhra, most of the intermediates were never used in production.
Why this matters for a system like SteamOS (inference, based on how SteamOS is built; Valve does not say it this way): an immutable system with A/B partitions only gets changes to its certificate store through an OS update. The same reasoning applies to any device, container or appliance image with a built-in CA bundle.
Packages and testing on Linux hosts
BleepingComputer lists these versions together with the revocation. A reader comment there reports a Debian fix on 20 October, which is not confirmed.
- Ubuntu:
ca-certificates20260816ubuntu0.*.1 - Arch:
ca-certificates-mozilla3.131.1-1 (NSS 3.131.1) - Alpine: 20261020-r0
- Debian: still pending, according to BleepingComputer
According to BleepingComputer, software with its own certificate store can keep trusting the compromised intermediates until it is updated itself. The report gives Go as an example: versions 1.27.3 and 1.26.10 fix CVE-2026-111943. It names emudhra.we-have-a-problem.com as a test address. To check whether a client knows about the revocation, connect to it from that client. A connection error is the result you want here (our inference).
What to do now
- Steam Deck or another SteamOS device: choose the Stable update channel in system settings and install 3.9.5. Then check desktop mode and Wi-Fi.
- Linux hosts and containers: bring the
ca-certificatespackage to the versions above. Rebuild container images that ship the package. - Software with its own certificate store (Java, Go binaries, individual clients): check for the vendor's update.
- Do not expect hibernation on the Steam Deck.
On the state of the sources: Phoronix lists no specific security fixes for 3.9.5. Valve's notes name exactly one, the eMudhra certificates, alongside general security and stability updates.
Further sources
- Valve: SteamOS 3.9.5 release notes: primary source for all changes
- Phoronix: SteamOS 3.9.5: kernel 7.2 as the base
- GamingOnLinux: SteamOS 3.9.5 released: stable for all supported systems
- Mozilla on oss-security: eMudhra: timeline and guidance for operators
- BleepingComputer: eMudhra certificates: cause, package versions, test address
- The Linux Experiment on YouTube: KDE Plasma 6.7 review: video on Plasma 6.7, 16 June 2026
- Simple Icons: steam.svg: logo under CC0, trademark of Valve
What is new in SteamOS 3.9.5?+
According to Valve's release notes the Linux kernel is now based on 7.2, desktop mode jumps from Plasma 6.4.3 to 6.7.3, the Arch Linux base is updated and the bootloader works with more motherboards. There is also a new Wi-Fi default (wpa_supplicant), lower idle power on the Steam Deck when no audio is playing, and the revocation of compromised eMudhra certificates. The notes cover all changes since the stable 3.8.
What happened to the eMudhra certificates?+
Mozilla says that on 17 October 2026 it learned that the private keys of 8 eMudhra intermediate certificates are compromised, 6 for TLS and 2 for code signing. eMudhra revoked them on 18 October, Sectigo on 19 October. BleepingComputer reports no sign of exploitation. SteamOS 3.9.5 revokes the certificates as well.
Can I use hibernation on the Steam Deck?+
No. Valve has added preliminary hibernation support, but it is not visible in the Game Mode interface and is switched off on the Steam Deck because of an open driver bug.