Executive brief
A vulnerability in the GNOME Remote Desktop component of Red Hat Enterprise Linux allows an attacker to crash or disable remote desktop services. By flooding the system with connection requests, an unauthenticated user can exhaust system resources, preventing legitimate administrators or users from logging in remotely. This issue specifically affects systems where the remote desktop daemon is running in 'system mode'.
Technical details
A flaw exists in the RDP ingress handling of gnome-remote-desktop when running in system mode (--system). The 'on_incoming_as_system_headless' handler in 'src/grd-rdp-server.c' bypasses the 'grd_throttler_handle_connection' mechanism used in other modes, instead passing connections directly to 'grd_routing_token_peek_async'. An unauthenticated remote attacker can exploit this by opening numerous parallel TCP connections to the RDP listener (typically port 3389). This accumulates accepted sockets and asynchronous routing-token operations, exhausting available resources and denying legitimate RDP access until the two-second peek timeout expires. The issue is specific to the Red Hat distribution and does not affect upstream GNOME.
Affected products
- Red Hat Red Hat Enterprise Linux 10 gnome-remote-desktop-49.3-1.el10
Timeline
- 2026-04-26: disclosed: Initial private notification to Red Hat
- 2026-07-31: advisory: CVE published by Red Hat and NVD