Denial of Service in gnome-remote-desktop via VNC TLS I/O Loop

A vulnerability (CVE-2026-109832) exists in the gnome-remote-desktop package as shipped in Red Hat Enterprise Linux (RHEL). The flaw stems from improper handling of specific GnuTLS return codes (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) within the VNC TLS I/O handlers. Instead of yielding control back to the event loop, the application enters an unbounded busy loop. A remote attacker capable of connecting to an enabled VNC TLS listener can trigger this condition, causing the event-loop thread to pin at 100% CPU usage. This prevents the application from making forward progress, effectively resulting in a denial-of-service condition for the remote desktop session.

Impact

The vulnerability results in a denial-of-service, preventing legitimate users from accessing or maintaining remote desktop sessions via the affected gnome-remote-desktop service. Targeted systems running RHEL with remote VNC access enabled are at risk of resource exhaustion on the event-loop thread, potentially impacting system stability depending on the configuration and threading model of the service.

Recommendation

Prioritized actions for security and IT teams include:

• Monitor system logs for repeated or unexplained high CPU usage originating from the gnome-remote-desktop process.
• Identify all RHEL systems with gnome-remote-desktop enabled and VNC listeners exposed to the network.
• Patch CVE-2026-109832 by applying the security updates provided by Red Hat once available.
• Restrict access to VNC TLS listeners to trusted network segments to mitigate the risk of remote triggering by unauthorized actors.