Critical Security Flaw in gpsd-minimal Package: Arbitrary Command Execution Vulnerability
Summary
ALSA-2026:65606: Important: gpsd-minimal security update. Affects gpsd-minimal versions < 1:3.26.1-2.el9_8.2. Fixed in 1:3.26.1-2.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd-minimal is a lightweight service daemon that facilitates access to GPS sensors connected to a host computer via serial or USB interfaces. It enables applications to query location, course, and velocity data over TCP port 2947. This package is part of the AlmaLinux ecosystem, which provides limited support for gpsd. The vulnerability in question exposes the package to potential exploitation, allowing unauthorized command execution.
Vulnerability Detail
The vulnerability identified as CVE-2026-60122 allows for arbitrary OS command execution through code injection in the gpsprof utility of the gpsd-minimal package. This flaw arises from improper handling of user input, which can be exploited by an attacker to execute malicious commands on the host system. The ramifications of this vulnerability are significant, as it could lead to unauthorized access, data breaches, or complete system compromise.
How To Fix
Minimum fixed version
1:3.26.1-2.el9_8.2
This is the first release that contains the fix.
sudo dnf update gpsd-minimalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the gpsd service by configuring firewall rules to limit connections to trusted IP addresses only. This can be done using the following command:
sudo firewall-cmd --add-rich-rule="rule family='ipv4' source address='YOUR_TRUSTED_IP' accept"
Replace 'YOUR_TRUSTED_IP' with the actual IP address you wish to allow.
Conclusion
The gpsd-minimal package has a critical vulnerability (CVE-2026-60122) that allows for arbitrary command execution. It is crucial to update to the patched version to secure your system. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for gpsd-minimal →
FAQ
CVE-2026-60122 is a security vulnerability in the gpsd-minimal package that allows arbitrary OS command execution via code injection.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized command execution, which may result in data breaches, system compromise, or other malicious activities.
You can update the package by running the command 'sudo dnf update gpsd-minimal gpsd-minimal-clients' in your terminal.
Yes, you can restrict access to the gpsd service by configuring firewall rules to allow connections only from trusted IP addresses.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd-minimal.
