Critical UNKNOWN READ Vulnerability in gpsd Package
Summary
OSV-2026-205: UNKNOWN READ in gpsd_poll. Affects gpsd versions >= 4d719d0f956444fa8cc00d988fbb9dda878614f4, < 454e3a856bdc4c0004fab000f23aec75af41c325. Fixed in 454e3a856bdc4c0004fab000f23aec75af41c325. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is an open-source GPS service daemon that monitors one or more GPS devices and makes their data available to clients. It is widely used in various applications that require location tracking and navigation. The package is designed to handle GPS data efficiently, but like many software components, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as UNKNOWN READ in the gpsd_poll function poses a risk of crashing the application. This issue was reported through OSS-Fuzz, indicating that the vulnerability can be triggered under certain conditions, leading to potential denial of service. The crash occurs due to improper handling of memory, which could allow an attacker to exploit this flaw to disrupt the service or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
454e3a856bdc4c0004fab000f23aec75af41c325
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider disabling the gpsd service until the patch can be applied. This can be done using the following command:
sudo systemctl stop gpsd
This will prevent the service from running and mitigate the risk of exploitation until the vulnerability is resolved.
Conclusion
The UNKNOWN READ vulnerability in the gpsd package poses a significant risk that can lead to application crashes and potential data exposure. It is crucial to update to the patched version to ensure the security and stability of applications relying on gpsd. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to issues without requiring access to the code.
See every vulnerability recorded for gpsd →
FAQ
The UNKNOWN READ vulnerability is a memory handling issue in the gpsd_poll function that can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to denial of service, causing the application to crash and potentially exposing sensitive data.
Yes, a patch has been released in version 454e3a856bdc4c0004fab000f23aec75af41c325 of the gpsd package.
If immediate updates are not possible, consider stopping the gpsd service to mitigate the risk until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
