Critical Command Injection Vulnerability in gpsd Package
Summary
ALSA-2026:51075: Important: gpsd security update. Affects gpsd versions < 1:3.26.1-3.el10_2.1. Fixed in 1:3.26.1-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is a service daemon that facilitates access to GPS sensors connected via serial or USB interfaces. It allows multiple GPS client applications to share access to GPS data without contention, providing a more manageable data format compared to NMEA 0183. The AlmaLinux support for gpsd is limited, and users are encouraged to refer to the AlmaLinux support policy for more details.
Vulnerability Detail
The vulnerability identified as CVE-2026-58459 in the gpsd package is a command injection flaw that arises from improper handling of GPS device subtypes. This vulnerability allows an attacker to execute arbitrary code on the host system by exploiting the GPS data processed by gpsd. The potential ramifications include unauthorized access to the system, data manipulation, and further exploitation of connected systems.
How To Fix
Minimum fixed version
1:3.26.1-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update gpsdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the gpsd service by configuring firewall rules to limit connections to trusted IP addresses only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The gpsd package has a critical command injection vulnerability that can lead to arbitrary code execution. Users are strongly advised to update to the latest patched version to mitigate risks. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for gpsd →
FAQ
The vulnerability is a command injection flaw that allows arbitrary code execution through improper handling of GPS device subtypes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to the system, data manipulation, and the risk of further exploitation of connected systems.
Yes, a patched version of the gpsd package is available. Users should update to version 1:3.26.1-3.el10_2.1.
If immediate updates are not possible, consider implementing firewall rules to restrict access to the gpsd service as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
