Critical Security Flaw in gpsd Package: Arbitrary OS Command Execution
Summary
ALSA-2026:65162: Important: gpsd security update. Affects gpsd versions < 1:3.26.1-3.el10_2.2. Fixed in 1:3.26.1-3.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
gpsd is a service daemon that facilitates access to GPS sensors connected via serial or USB interfaces. It allows multiple GPS client applications to share access to GPS data without contention, providing a more user-friendly data format than NMEA 0183. However, the AlmaLinux support for this package is limited, which may affect its reliability and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-60122 allows for arbitrary OS command execution through code injection in the gpsprof utility of the gpsd package. This flaw can be exploited by an attacker to execute unauthorized commands on the host system, potentially leading to data breaches or system compromise. The issue arises from insufficient input validation in the gpsprof utility, making it susceptible to crafted input that can manipulate the execution flow.
How To Fix
Minimum fixed version
1:3.26.1-3.el10_2.2
This is the first release that contains the fix.
sudo dnf update gpsdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the gpsd service or disable the gpsprof utility until the package is updated. This can be done by modifying the service configuration or removing the gpsprof binary from the system.
Conclusion
The gpsd package has a critical vulnerability (CVE-2026-60122) that allows for arbitrary OS command execution. It is essential to update to the patched version to secure your system. Temporary workarounds can be implemented while waiting for the update.
See every vulnerability recorded for gpsd →
FAQ
The vulnerability can lead to arbitrary command execution, allowing attackers to gain unauthorized access to the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
Yes, a patched version of the gpsd package is available. Update to version 1:3.26.1-3.el10_2.2 to mitigate the risk.
Consider restricting access to the gpsd service or disabling the gpsprof utility as a temporary workaround.
For more details, refer to the AlmaLinux support policy for gpsd at https://access.AlmaLinux.com/support/policy/gpsd-support.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
