CVE-2026-18358: gnome-remote-desktop DoS Vulnerability

CVE-2026-18358 Overview

CVE-2026-18358 is a resource exhaustion vulnerability in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon runs in system mode with Remote Desktop Protocol (RDP) enabled, the incoming connection handler bypasses the connection throttler. This allows an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. Accepted sockets and pending routing-token operations accumulate until timeout, exhausting resources and blocking legitimate RDP sessions. The upstream gnome-remote-desktop version is not affected. The weakness is classified as Uncontrolled Resource Consumption [CWE-400].

Critical Impact
Unauthenticated network attackers can deny RDP access to legitimate users by flooding the listener with pre-authentication connections.

Affected Products

Red Hat Enterprise Linux gnome-remote-desktop package (system mode with RDP enabled)
Systems configured to expose the RDP listener over the network
Downstream Red Hat distributions incorporating the affected package build

Discovery Timeline

2026-07-31 - CVE-2026-18358 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in the NVD database

Technical Details for CVE-2026-18358

Vulnerability Analysis

The flaw resides in the incoming connection handler of gnome-remote-desktop when the daemon operates in system mode with RDP enabled. The handler accepts inbound sockets without enforcing the connection throttler that normally limits concurrent pre-authentication sessions. An attacker can open a large number of simultaneous connections to the RDP listener without authenticating. Each accepted connection consumes a socket and initiates a routing-token operation that remains pending until it times out. As connections accumulate, the daemon exhausts available file descriptors and internal state slots, preventing new session establishment.

Root Cause

The root cause is a missing enforcement path in the Red Hat downstream patchset. The connection throttler exists but is not invoked before the daemon commits resources to a new RDP connection. This condition maps to [CWE-400] Uncontrolled Resource Consumption. The issue is specific to the Red Hat build and does not affect the upstream gnome-remote-desktop codebase.

Attack Vector

Exploitation requires only network reachability to the RDP listener. No credentials, user interaction, or prior foothold are needed. An attacker scripts many parallel TCP connections against the RDP port, holding each open through the pre-authentication phase. Because routing-token operations run to timeout rather than being rejected early, sustained connection pressure keeps the daemon saturated. The result is a denial of service against remote desktop availability while leaving confidentiality and integrity intact.

No verified proof-of-concept code is published. See the Red Hat CVE-2026-18358 Advisory and Red Hat Bug Report #2462876 for technical detail as it becomes available.

Detection Methods for CVE-2026-18358

Indicators of Compromise

Sudden spike in half-open or pre-authentication TCP connections to the RDP listener port from one or more remote sources
gnome-remote-desktop process holding an abnormally high count of open sockets or file descriptors
Legitimate users reporting failed RDP session establishment while the daemon remains running
Repeated routing-token timeout entries in gnome-remote-desktop logs or journalctl output

Detection Strategies

Monitor RDP listener socket counts on affected hosts using ss -tan state syn-recv and lsof -p <pid> against the daemon
Alert on rapid growth of established connections to the RDP port without corresponding successful authentication events
Correlate network flow telemetry for high-fanout sources connecting to RDP endpoints across multiple RHEL hosts
Baseline normal pre-authentication connection duration and flag deviations that indicate held-open sockets

Monitoring Recommendations

Ingest gnome-remote-desktop service logs and systemd journal events into a centralized logging platform
Track file descriptor limits and current usage for the daemon and alert on approach to ulimit thresholds
Monitor network-layer connection rate metrics on RDP-listening interfaces for sustained bursts
Review firewall and IDS logs for repeated short-lived connections to TCP port 3389 or the configured RDP port

How to Mitigate CVE-2026-18358

Immediate Actions Required

Apply Red Hat security updates for gnome-remote-desktop once available for your RHEL release
Restrict network access to the RDP listener using host and network firewalls, allowing only known administrative sources
Disable RDP in gnome-remote-desktop system mode on hosts that do not require remote desktop access
Enforce rate limiting at the network layer for inbound connections to the RDP port

Patch Information

Refer to the Red Hat CVE-2026-18358 Advisory for the authoritative list of fixed package versions and errata. The upstream gnome-remote-desktop project is not affected, so users of upstream builds do not require a patch. Track Red Hat Bug Report #2462876 for status updates on downstream fixes.

Workarounds

Front the RDP listener with a network device or reverse proxy that enforces per-source connection limits
Bind gnome-remote-desktop to a management VLAN or VPN-only interface to reduce exposure
Apply firewalld or nftables rules to cap concurrent connections per source IP to the RDP port
Temporarily switch to user-mode RDP or an alternative remote access solution on affected hosts

bash

# Example nftables rule limiting concurrent RDP connections per source
nft add rule inet filter input tcp dport 3389 ct state new \
  meter rdp_flood { ip saddr limit rate 10/minute } accept
nft add rule inet filter input tcp dport 3389 ct state new drop