Critical Security Flaw in gpsd-minimal Package: Arbitrary OS Command Execution
Summary
RLSA-2026:65606: Important: gpsd-minimal security update. Affects gpsd-minimal versions < 1:3.26.1-2.el9_8.2. Fixed in 1:3.26.1-2.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd-minimal is a lightweight service daemon that facilitates access to GPS sensors connected via serial or USB interfaces. It provides location, course, and velocity data, which can be queried over TCP port 2947. This package is part of the Rocky Linux ecosystem, and its support is limited by the Rocky Enterprise Software Foundation. The vulnerability in question exposes users to significant security risks due to improper handling of input in the gpsprof utility.
Vulnerability Detail
The vulnerability identified as CVE-2026-60122 allows for arbitrary OS command execution through code injection in the gpsprof utility of the gpsd-minimal package. This flaw arises from insufficient validation of user input, enabling attackers to execute malicious commands on the host system. The potential ramifications include unauthorized access to system resources, data breaches, and complete system compromise, making it a critical security issue.
How To Fix
Minimum fixed version
1:3.26.1-2.el9_8.2
This is the first release that contains the fix.
sudo dnf update gpsd-minimalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the gpsd service by configuring firewall rules to limit connections to trusted IP addresses only. This can be done using the following command:
sudo firewall-cmd --add-rich-rule="rule family='ipv4' source address='trusted_ip_address' accept"
Replace 'trusted_ip_address' with the actual IP address you wish to allow.
Conclusion
The gpsd-minimal package has a critical vulnerability that allows for arbitrary OS command execution through the gpsprof utility. Users are strongly advised to update to the latest patched version to mitigate risks. Additionally, temporary workarounds can be implemented to enhance security until the update is applied.
See every vulnerability recorded for gpsd-minimal →
FAQ
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential impacts include unauthorized command execution, data breaches, and system compromise.
Yes, you can restrict access to the gpsd service using firewall rules to limit connections to trusted IP addresses.
The gpsd-minimal package is maintained by the Rocky Enterprise Software Foundation, which provides limited support for this package.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd-minimal.
