CVE-2026-96541: GNOME Remote Desktop DOS Vulnerability

CVE-2026-96541 Overview

CVE-2026-96541 is a denial-of-service vulnerability in gnome-remote-desktop, the GNOME implementation of the Remote Desktop Protocol (RDP). An unauthenticated remote attacker can open RDP connections without completing the handshake and hold the connection-throttling slots indefinitely. The service does not enforce a pre-authentication handshake deadline, so partial connections are never reaped. By exhausting the global connection limit, an attacker prevents legitimate RDP clients from connecting until a holding socket is closed. The flaw is tracked under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
A single unauthenticated attacker can block all new RDP sessions to a gnome-remote-desktop host by holding open half-completed connections.

Affected Products

GNOME gnome-remote-desktop (RDP session backend)
Linux distributions shipping vulnerable gnome-remote-desktop builds
Red Hat Enterprise Linux (see Red Hat CVE-2026-96541 Advisory)

Discovery Timeline

2026-09-23 - CVE CVE-2026-96541 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96541

Vulnerability Analysis

The gnome-remote-desktop daemon accepts inbound RDP connections and enforces a global connection-throttling limit to protect the service from overload. Each accepted TCP socket consumes one slot in this pool. The RDP handshake proceeds through negotiation, security, and authentication phases before a session is established.

The vulnerability arises because the daemon does not set a deadline for completing the pre-authentication handshake. An attacker can open a TCP connection, send partial or no RDP handshake data, and the socket stays parked in the throttling pool. Slots are only released when the holding socket is finally closed by the client or by an external event.

Because the attacker never authenticates and no protocol progress is required, this is a pure resource-exhaustion condition against unauthenticated remote clients. Impact is limited to availability of the RDP service. Confidentiality and integrity are not affected.

Root Cause

The root cause is a missing timeout on the pre-authentication phase of the RDP connection lifecycle. The connection accounting code decrements available slots on accept() but has no watchdog that closes idle or stalled sockets before authentication completes. This maps to CWE-400, Uncontrolled Resource Consumption.

Attack Vector

The attack is remote and requires no privileges or user interaction. An attacker with network reach to the RDP port (typically TCP 3389) opens connections up to the configured global limit and holds them open. New RDP clients then fail to connect until one of the attacker's sockets is closed. Basic tooling such as nc, hping3, or a small script that opens many TCP sockets is sufficient. See GNOME Remote Desktop Issue #356 for upstream discussion.

No verified proof-of-concept code has been published. The mechanism can be reproduced by opening TCP sockets to the RDP listener and refraining from sending handshake data.

Detection Methods for CVE-2026-96541

Indicators of Compromise

Multiple concurrent TCP connections to the gnome-remote-desktop RDP port from a single source that never advance past the RDP handshake.
Legitimate users reporting failure to establish new RDP sessions while the daemon is running.
gnome-remote-desktop logs showing accepted connections without matching authentication or session-established events.

Detection Strategies

Monitor connection counts on TCP 3389 per source address and alert on sustained high concurrency from a single peer.
Correlate accept() events with authentication-success or session-start events in gnome-remote-desktop logs and flag large gaps.
Baseline normal RDP session establishment latency and alert when handshake completion rates drop.

Monitoring Recommendations

Ingest journald and gnome-remote-desktop logs into a centralized logging or SIEM platform for correlation.
Track network flow telemetry for long-lived TCP connections to RDP endpoints that transfer minimal bytes.
Alert when the count of half-open or idle RDP connections approaches the configured global limit.

How to Mitigate CVE-2026-96541

Immediate Actions Required

Restrict inbound access to the RDP port using a host firewall (nftables, firewalld) or network ACL so only trusted sources can reach gnome-remote-desktop.
Require a VPN or bastion host in front of any exposed RDP service rather than exposing the port directly to the internet.
Disable gnome-remote-desktop on hosts that do not require remote RDP access until a patch is applied.

Patch Information

Apply the vendor-provided update for gnome-remote-desktop once available. Track fix status through the Red Hat CVE-2026-96541 Advisory, the Red Hat Bug Report #2539385, and the upstream GNOME Remote Desktop Issue #356. The upstream fix introduces a deadline on the pre-authentication handshake so stalled sockets release their throttling slot.

Workarounds

Place gnome-remote-desktop behind a reverse proxy or gateway that enforces its own handshake timeout and per-source connection limits.
Use firewall rate-limiting to cap concurrent connections per source IP to the RDP port.
Rely on identity-aware access controls (VPN, SSO gateway) instead of exposing the RDP listener to untrusted networks.

bash

# Example: limit concurrent connections per source IP to TCP 3389 with nftables
nft add table inet rdp_guard
nft add chain inet rdp_guard input { type filter hook input priority 0 \; }
nft add rule inet rdp_guard input tcp dport 3389 ct state new \
  meter rdp_conns { ip saddr limit rate 10/minute } accept
nft add rule inet rdp_guard input tcp dport 3389 ct count over 20 drop