Red Hat Security Advisory: gpsd-minimal security update
Red Hat has issued a security advisory for gpsd-minimal addressing two vulnerabilities: a denial of service caused by malformed NAVCOM packet parsing (CVE-2025-67269) and arbitrary code execution via a heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268). These issues affect gpsd, a daemon that provides GPS sensor data over TCP port 2947. The advisory covers Red Hat Enterprise Linux 9 and related variants. The update is rated as Important by Red Hat Product Security. A fix is available in updated gpsd-minimal packages for affected Red Hat Enterprise Linux 9 versions.
AI Analysis
Technical Summary
The gpsd service daemon, which mediates access to GPS sensors connected via serial or USB interfaces and exposes location data on TCP port 2947, contains two security vulnerabilities. CVE-2025-67269 allows denial of service through malformed NAVCOM packet parsing. CVE-2025-67268 enables arbitrary code execution due to a heap-based out-of-bounds write in NMEA2000 packet handling. Red Hat has released updated gpsd-minimal packages for Red Hat Enterprise Linux 9 and its variants to address these issues. The advisory is identified as RHSA-2026:0771 and rates the impact as Important. The vulnerabilities correspond to CWE-1285 (Improper Neutralization of Special Elements) and CWE-191 (Integer Underflow).
Potential Impact
Successful exploitation of CVE-2025-67269 can cause denial of service by crashing the gpsd daemon when processing malformed NAVCOM packets. CVE-2025-67268 can lead to arbitrary code execution on the host system via a heap-based out-of-bounds write during NMEA2000 packet handling. These vulnerabilities could allow attackers to disrupt GPS data services or execute code with the privileges of the gpsd process, potentially leading to system compromise.
Mitigation Recommendations
Red Hat has released updated gpsd-minimal packages for Red Hat Enterprise Linux 9 and related variants that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:0771 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in the updated packages.
Red Hat Security Advisory: gpsd-minimal security update
Description
Red Hat has issued a security advisory for gpsd-minimal addressing two vulnerabilities: a denial of service caused by malformed NAVCOM packet parsing (CVE-2025-67269) and arbitrary code execution via a heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268). These issues affect gpsd, a daemon that provides GPS sensor data over TCP port 2947. The advisory covers Red Hat Enterprise Linux 9 and related variants. The update is rated as Important by Red Hat Product Security. A fix is available in updated gpsd-minimal packages for affected Red Hat Enterprise Linux 9 versions.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The gpsd service daemon, which mediates access to GPS sensors connected via serial or USB interfaces and exposes location data on TCP port 2947, contains two security vulnerabilities. CVE-2025-67269 allows denial of service through malformed NAVCOM packet parsing. CVE-2025-67268 enables arbitrary code execution due to a heap-based out-of-bounds write in NMEA2000 packet handling. Red Hat has released updated gpsd-minimal packages for Red Hat Enterprise Linux 9 and its variants to address these issues. The advisory is identified as RHSA-2026:0771 and rates the impact as Important. The vulnerabilities correspond to CWE-1285 (Improper Neutralization of Special Elements) and CWE-191 (Integer Underflow).
Potential Impact
Successful exploitation of CVE-2025-67269 can cause denial of service by crashing the gpsd daemon when processing malformed NAVCOM packets. CVE-2025-67268 can lead to arbitrary code execution on the host system via a heap-based out-of-bounds write during NMEA2000 packet handling. These vulnerabilities could allow attackers to disrupt GPS data services or execute code with the privileges of the gpsd process, potentially leading to system compromise.
Mitigation Recommendations
Red Hat has released updated gpsd-minimal packages for Red Hat Enterprise Linux 9 and related variants that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:0771 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in the updated packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0771
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-67269"]
Threat ID: 6a27e99f8dd33fbd8516d62b
Added to database: 06/09/2026, 10:23:27 UTC
Last enriched: 06/28/2026, 00:59:16 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.