The gpsd daemon mediates access to GPS sensors connected via serial or USB interfaces and listens on TCP port 2947. A command injection vulnerability exists in the handling of the GPS device subtype, which allows an attacker to execute arbitrary code on the host system. This vulnerability is tracked as CVE-2026-58459 and is rated with high severity. Red Hat has released updated gpsd packages for Red Hat Enterprise Linux 10 to fix this issue. The vulnerability affects multiple specific versions of gpsd as listed in the advisory and Ubuntu LTS versions 16.04 through 26.04. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system with the privileges of the gpsd service. This could lead to full system compromise depending on the service context. The vulnerability impacts systems running vulnerable versions of gpsd on Red Hat Enterprise Linux 10 and various Ubuntu LTS versions.

Red Hat has released updated gpsd packages that fix this command injection vulnerability. Users should apply the security update provided in Red Hat Advisory RHSA-2026:51075 to remediate the issue. For detailed update instructions, refer to https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. No additional mitigations are indicated by the vendor advisory.