RLSA-2026:98510: Important: gnome-remote-desktop security update
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
gnome-remote-desktop: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLSEAGAIN / GNUTLSEINTERRUPTED) (CVE-2026-109832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gnome-remote-desktopto a version that resolves this vulnerability.Fixed in 0:40.0-13.el9_9 - Upgrade
Upgrade
rocky-linux/gnome-remote-desktop-debuginfoto a version that resolves this vulnerability.Fixed in 0:40.0-13.el9_9 - Upgrade
Upgrade
rocky-linux/gnome-remote-desktop-debugsourceto a version that resolves this vulnerability.Fixed in 0:40.0-13.el9_9
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates network-based exploitation with no privileges or user interaction required. Systems exposing GNOME Remote Desktop's VNC service are the relevant attack surface.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service through busy-wait behavior in the VNC TLS I/O handlers. The provided CVSS vector indicates no confidentiality or integrity impact, but high availability impact.
Which Rocky Linux packages are covered by this update?
The advisory lists gnome-remote-desktop, gnome-remote-desktop-debuginfo, and gnome-remote-desktop-debugsource.