Critical Security Flaw in gpsd Package: Denial of Service and Code Execution Risks
Summary
ALSA-2026:0770: Important: gpsd security update. Affects gpsd versions < 1:3.26.1-1.el10_1.1. Fixed in 1:3.26.1-1.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is a service daemon that facilitates access to GPS sensors connected to host computers via serial or USB interfaces. It enables multiple GPS client applications to share data without contention, providing location, course, and velocity information through an easily parsable format. However, vulnerabilities in gpsd can lead to severe security risks, affecting the integrity and availability of GPS data.
Vulnerability Detail
The gpsd package has two critical vulnerabilities. The first is a Denial of Service (DoS) vulnerability caused by malformed NAVCOM packet parsing (CVE-2025-67269), which can disrupt the service's availability. The second vulnerability allows for arbitrary code execution due to a heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268), potentially allowing attackers to execute malicious code on the host system.
How To Fix
Minimum fixed version
1:3.26.1-1.el10_1.1
This is the first release that contains the fix.
sudo dnf update gpsdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the gpsd service until the update can be applied. This can be done with the command:
sudo systemctl stop gpsd
However, this will prevent any GPS data access until the service is restarted after the update.
Conclusion
The gpsd package has critical vulnerabilities that pose significant risks to system security and availability. It is essential to update to the patched version to mitigate these risks. Users should also consider temporary workarounds while preparing for the update.
See every vulnerability recorded for gpsd →
FAQ
gpsd is a service daemon that provides access to GPS data from connected sensors, allowing multiple applications to use the data simultaneously.
The vulnerabilities can lead to Denial of Service, disrupting GPS data availability, and arbitrary code execution, which can compromise system security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider stopping the gpsd service as a temporary measure to mitigate risks until the update can be applied.
For more details, refer to the CVE pages for CVE-2025-67268 and CVE-2025-67269, which provide in-depth information about the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.