Red Hat Patches GNOME Remote Desktop Flaw That Leaves Unauthenticated RDP Sockets Hanging
Red Hat has published errata RHSA-2026:98622, a Moderate-rated security update for the gnome-remote-desktop package on Red Hat Enterprise Linux 10, released and updated on 11 November 2026. The advisory addresses a single issue, CVE-2026-96541, described by the vendor as unauthenticated RDP sockets lacking a handshake deadline. GNOME Remote Desktop is the remote desktop and screen sharing service used by the GNOME desktop environment, so the exposure sits on any RHEL 10 host where that service is enabled and reachable. Fixed packages are available as gnome-remote-desktop-49.3-18.el10_3 for x86_64, IBM z Systems s390x, Power little endian ppc64le and ARM 64 aarch64 builds. Red Hat tracks the issue internally as Bugzilla 2539385.
The errata text is deliberately brief on mechanics, and the vendor has not published an exploitation chain, proof-of-concept code or an attack narrative alongside the advisory, pointing readers instead to the CVE record for scoring detail. What the advisory does state is the nature of the weakness: a connection that reaches the RDP listener before any authentication occurs is not bound by a deadline for completing the protocol handshake. In practice that means a socket opened by an unauthenticated peer can sit in an incomplete state rather than being torn down by the service. Red Hat has rated the overall security impact as Moderate and has not indicated that the flaw permits code execution or access to session data. Our team is treating anything beyond the vendor description as unverified.
The practical concern here is service resilience rather than data theft. Hosts most relevant to this advisory are RHEL 10 workstations, virtual desktop images and administrative jump systems where GNOME screen sharing has been turned on and the RDP port is reachable from a user network or, worse, from the internet. Because the weakness is reached before authentication, strong credentials and multi-factor controls on the desktop session offer no protection against the condition itself. On current exploitation status, FIRST EPSS places CVE-2026-96541 at a 1.0% probability of exploitation in the next 30 days, and no in-the-wild activity is reported in the advisory. Fixed packages are already in the Red Hat repositories, which puts this in the routine maintenance band rather than the emergency one.
Attack Surface
Remote Access Service, Endpoint OS, Server OS
Tactics
Impact, Initial Access
Techniques
- T1499 – Endpoint Denial of Service
- T1021.001 – Remote Services: Remote Desktop Protocol
- T1190 – Exploit Public-Facing Application
SuperPRO's Threat Countermeasures Procedures
- Apply the RHSA-2026:98622 update so gnome-remote-desktop reaches version 49.3-18.el10_3 or later on Red Hat Enterprise Linux 10 using 'dnf update gnome-remote-desktop', covering x86_64, s390x, ppc64le and aarch64 estates.
- Validate the downloaded packages against the SHA-256 digests published in the errata, including the shared SRPM gnome-remote-desktop-49.3-18.el10_3.src.rpm (2eb4b7d3651adf249c3c5b86444fd6e23f8f775f05d508a3e365d554a9458494) before deployment to production hosts.
- Use the Red Hat Insights patch analysis referenced in the advisory to enumerate every RHEL 10 system carrying a vulnerable gnome-remote-desktop build, rather than relying on manual inventory.
- Where GNOME screen sharing is not a business requirement, turn the service off with 'systemctl –user disable –now gnome-remote-desktop.service' and confirm RDP sharing is off via 'grdctl rdp disable'.
- Restrict inbound TCP/3389 to administrative VLANs or VPN ranges with a firewalld rich rule on affected RHEL 10 hosts, and confirm no gnome-remote-desktop listener is exposed to untrusted networks using 'ss -ltnp | grep 3389'.
- Alert in network monitoring on a single source opening large numbers of concurrent connections to TCP/3389 on RHEL 10 endpoints without completing the RDP handshake, as this matches the unbounded pre-authentication socket condition described in CVE-2026-96541.
