Critical Security Update for gpsd-minimal: Addressing Denial of Service and Code Execution Vulnerabilities
Summary
ALSA-2026:0771: Important: gpsd-minimal security update. Affects gpsd-minimal versions < 1:3.26.1-1.el9_7.1. Fixed in 1:3.26.1-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is a service daemon that facilitates access to GPS sensors connected to host computers via serial or USB interfaces. It allows applications to query location, course, and velocity data through TCP port 2947. The AlmaLinux support for this package is limited, which means users may not receive extensive updates or assistance. This vulnerability affects the gpsd-minimal package, which is a lightweight version of the gpsd service.
Vulnerability Detail
The gpsd-minimal package has two significant vulnerabilities. The first, identified as CVE-2025-67269, allows for Denial of Service due to improper parsing of malformed NAVCOM packets. The second vulnerability, CVE-2025-67268, enables arbitrary code execution through a heap-based out-of-bounds write during NMEA2000 packet handling. These vulnerabilities can lead to severe impacts, including service interruptions and unauthorized code execution on affected systems.
How To Fix
Minimum fixed version
1:3.26.1-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update gpsd-minimalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the TCP port 2947 to prevent unauthorized access while waiting for the patch. This can be done by configuring your firewall settings to block incoming connections to that port.
Conclusion
The gpsd-minimal package has critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with Denial of Service and arbitrary code execution. Implementing temporary workarounds can help secure systems until updates are applied.
See every vulnerability recorded for gpsd-minimal →
FAQ
gpsd-minimal is a lightweight version of the gpsd service that allows applications to access GPS data from connected sensors.
The vulnerabilities can lead to Denial of Service attacks and arbitrary code execution, potentially compromising the security of the host system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, you can restrict access to TCP port 2947 using firewall settings as a temporary workaround.
More details can be found on the CVE pages for CVE-2025-67268 and CVE-2025-67269.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd-minimal.
