Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 8 articles for you...
89
security advisoryfedoraarbitrary code executionFedora 44 gpsd Command Injection Vulnerability Resolution 2026-36e3aa0593
Security fix for CVE-2026-58459. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-36e3aa0593 2026-07-21 00:56:03.169751+00:00 -------------------------------------------------------------------------------- Name : gpsd Product : Fedora 44 Version : 3.27.5 Release : 5.fc44 URL : https://gpsd.gitlab.io/gpsd/index.html Summary : Service daemon for mediating access to a GPS Description : gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2026-58459 -------------------------------------------------------------------------------- ChangeLog: * Mon Jul 13 2026 Miroslav Lichvar - 1:3.27.5-5 - fix command injection in gpsprof (CVE-2026-58459) * Wed Jun 3 2026 Python Maint - 1:3.27.5-4 - Rebuilt for Python 3.15 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2498940 - CVE-2026-58459 gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2498940 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-36e3aa0593' at the command line. For more information, refer to the dnf documentation availableat http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 20, 2026
•Important
Fedora
202
security advisorymoderateupdateopenSUSE Tumbleweed gpsd Moderate CVE-2026-58459 Advisory 2026-11276-1
An update that solves one vulnerability can now be installed.. # gpsd-3.27.5-3.1 on GA media Announcement ID: openSUSE-SU-2026:11276-1 Rating: moderate Cross-References: * CVE-2026-58459 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the gpsd-3.27.5-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * gpsd 3.27.5-3.1 * gpsd-clients 3.27.5-3.1 * gpsd-devel 3.27.5-3.1 * gpsd-qt6-devel 3.27.5-3.1 * libQgpsmm32 3.27.5-3.1 * libgps32 3.27.5-3.1 * python3-gpsd 3.27.5-3.1 ## References: * https://www.suse.com/security/cve/CVE-2026-58459.html . An openSUSE update resolves a moderate security issue in gpsd package, enhancing system safety.. openSUSE gpsd update security issue moderate severity. . Severity: moderate. LinuxSecurity.com Team
Jul 16, 2026
•moderate
OpenSUSE
203
security advisorycriticalDoS attackMageia 9 gpsd Critical DoS Heap Overflow Vulnerability MGASA-2026-0028
MGASA-2026-0028 - Updated gpsd packages fix security vulnerabilities. MGASA-2026-0028 - Updated gpsd packages fix security vulnerabilities Publication date: 30 Jan 2026 URL: https://advisories.mageia.org/MGASA-2026-0028.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-67268, CVE-2025-67269 Description: gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution. (CVE-2025-67268) An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer-> length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer-> length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition. (CVE-2025-67269) References: - https://bugs.mageia.org/show_bug.cgi?id=34959 - https://ubuntu.com/security/notices/USN-7948-1 - https://www.cve.org/CVERecord?id=CVE-2025-67268 - https://www.cve.org/CVERecord?id=CVE-2025-67269 SRPMS: - 9/core/gpsd-3.25-1.1.mga9 . Updated gpsd packages for Mageia fix critical vulnerabilities and prevent potential DoS attacks.. Mageia gpsd security advisory heap overflow DoS. . Severity: Critical. LinuxSecurity.com Team
Jan 30, 2026
•Critical
Mageia
219
security advisorydenial of servicecode executionRocky Linux 10 gpsd Major Denial of Service Code Execution RLSA-2026-0770
Important: gpsd security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:0770", "synopsis": "Important: gpsd security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for gpsd.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.\n\nSecurity Fix(es):\n\n* gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)\n\n* gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2426835", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2426835", "description": ""}, {"ticket": "2426810", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2426810", "description": ""}], "cves": [{"name": "CVE-2025-67268", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-67268", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-1285"}, {"name": "CVE-2025-67269", "sourceBy": "MITRE", "sourceLink":"https://www.cve.org/CVERecord?id=CVE-2025-67269", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-191"}], "references": [], "publishedAt": "2026-01-21T09:06:31.007549Z", "rpms": {"Rocky Linux 10": {"nvras": ["gpsd-clients-1:3.26.1-1.el10_1.1.s390x.rpm", "gpsd-debuginfo-1:3.26.1-1.el10_1.1.s390x.rpm", "gpsd-1:3.26.1-1.el10_1.1.aarch64.rpm", "python3-gpsd-1:3.26.1-1.el10_1.1.ppc64le.rpm", "gpsd-1:3.26.1-1.el10_1.1.x86_64.rpm", "python3-gpsd-debuginfo-1:3.26.1-1.el10_1.1.s390x.rpm", "gpsd-debugsource-1:3.26.1-1.el10_1.1.x86_64.rpm", "gpsd-1:3.26.1-1.el10_1.1.ppc64le.rpm", "python3-gpsd-1:3.26.1-1.el10_1.1.s390x.rpm", "gpsd-1:3.26.1-1.el10_1.1.s390x.rpm", "gpsd-debuginfo-1:3.26.1-1.el10_1.1.x86_64.rpm", "gpsd-clients-debuginfo-1:3.26.1-1.el10_1.1.ppc64le.rpm", "python3-gpsd-debuginfo-1:3.26.1-1.el10_1.1.aarch64.rpm", "gpsd-debuginfo-1:3.26.1-1.el10_1.1.ppc64le.rpm", "gpsd-debugsource-1:3.26.1-1.el10_1.1.s390x.rpm", "gpsd-clients-debuginfo-1:3.26.1-1.el10_1.1.aarch64.rpm", "gpsd-1:3.26.1-1.el10_1.1.src.rpm", "python3-gpsd-1:3.26.1-1.el10_1.1.aarch64.rpm", "gpsd-clients-1:3.26.1-1.el10_1.1.x86_64.rpm", "python3-gpsd-1:3.26.1-1.el10_1.1.x86_64.rpm", "gpsd-debugsource-1:3.26.1-1.el10_1.1.ppc64le.rpm", "gpsd-clients-1:3.26.1-1.el10_1.1.aarch64.rpm", "gpsd-debuginfo-1:3.26.1-1.el10_1.1.aarch64.rpm", "python3-gpsd-debuginfo-1:3.26.1-1.el10_1.1.x86_64.rpm", "gpsd-clients-debuginfo-1:3.26.1-1.el10_1.1.x86_64.rpm", "python3-gpsd-debuginfo-1:3.26.1-1.el10_1.1.ppc64le.rpm", "gpsd-debugsource-1:3.26.1-1.el10_1.1.aarch64.rpm", "gpsd-clients-1:3.26.1-1.el10_1.1.ppc64le.rpm", "gpsd-clients-debuginfo-1:3.26.1-1.el10_1.1.s390x.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Security update for gpsd on Rocky Linux addresses critical issues revealing denial of service and arbitrary code execution risks.. gpsd security, Rocky Linux update, Denial of Service, arbitrary code execution. . Severity: Important. LinuxSecurity.com Team
Jan 21, 2026
•Important
Rocky Linux
217
security advisorybuffer overflowimportantOracle Linux 10: gpsd Important Buff Overflow CVE-2025-67268 ELSA-2026-0770
The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-0770 http://linux.oracle.com/errata/ELSA-2026-0770.html The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network: x86_64: gpsd-3.26.1-1.0.1.el10_1.1.x86_64.rpm gpsd-clients-3.26.1-1.0.1.el10_1.1.x86_64.rpm python3-gpsd-3.26.1-1.0.1.el10_1.1.x86_64.rpm aarch64: gpsd-3.26.1-1.0.1.el10_1.1.aarch64.rpm gpsd-clients-3.26.1-1.0.1.el10_1.1.aarch64.rpm python3-gpsd-3.26.1-1.0.1.el10_1.1.aarch64.rpm SRPMS: http://oss.oracle.com/ol10/SRPMS-updates/gpsd-3.26.1-1.0.1.el10_1.1.src.rpm Related CVEs: CVE-2025-67268 CVE-2025-67269 Description of changes: [1:3.26.1-1.0.1.el10_1.1] - Replace upstream reference [Orabug: 37033219] [1:3.26.1-1.el10_1.1] - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) _______________________________________________ El-errata mailing list
Jan 21, 2026
•Important
Oracle
89
security advisorydenial of servicefedoraFedora 42: gpsd Critical Buffer Overflow & DoS CVE-2025-67268 Advisory
Security fixes for CVE-2025-67268 and CVE-2025-67269.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-a1552b48c3 2026-01-20 01:37:20.162017+00:00 -------------------------------------------------------------------------------- Name : gpsd Product : Fedora 42 Version : 3.25 Release : 17.fc42 URL : https://gpsd.gitlab.io/gpsd/index.html Summary : Service daemon for mediating access to a GPS Description : gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. -------------------------------------------------------------------------------- Update Information: Security fixes for CVE-2025-67268 and CVE-2025-67269. -------------------------------------------------------------------------------- ChangeLog: * Mon Jan 12 2026 Miroslav Lichvar - 1:3.25-17 - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2426827 - CVE-2025-67269 gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2426827 [ 2 ] Bug #2426828 - CVE-2025-67269 gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2426828 [ 3 ] Bug #2426932 - CVE-2025-67268 gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write inNMEA2000 packet handling [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2426932 [ 4 ] Bug #2426933 - CVE-2025-67268 gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2426933 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-a1552b48c3' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jan 20, 2026
•Critical
Fedora
197
security advisorycriticalheap corruptionDebian 11: gpsd Critical DoS Heap Issue DLA-4441-1 CVE-2025-67268
Multiple vulnerabilities were fixed in gpsd a service daemon that monitors one or more GNSS (GPS) or AIS receivers attached to a host computer through serial or USB ports. CVE-2025-67268 gpsd contains a heap-based out-of-bounds write. From: Bastien Roucari��s To: debian-lts-announce@lists.debian.org Subject: [SECURITY] [DLA 4441-1] gpsd security update Debian LTS Advisory DLA-4441-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Bastien Roucari��s January 19, 2026 https://wiki.debian.org/LTS Package : gpsd Version : 3.22-4+deb11u1 CVE ID : CVE-2025-67268 CVE-2025-67269 Debian Bug : 1124799 1124800 Multiple vulnerabilities were fixed in gpsd a service daemon that monitors one or more GNSS (GPS) or AIS receivers attached to a host computer through serial or USB ports. CVE-2025-67268 gpsd contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution. CVE-2025-67269 An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c`. When parsing a NAVCOM packet, the payload length is calculated using `lexer-> length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer-> length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition. For Debian 11 bullseye,these problems have been fixed in version 3.22-4+deb11u1. We recommend that you upgrade your gpsd packages. For the detailed security status of gpsd please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/gpsd Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Critical security update for gpsd on Debian LTS addressing multiple vulnerabilities including DoS risks and heap corruption.. gpsd security update, Debian LTS advisory, heap corruption fix, Denial of Service. . Severity: Critical. LinuxSecurity.com Team
Jan 19, 2026
•Critical
Debian LTS
89
security advisorydenial of servicefedoraFedora 43 gpsd Security Fixes CVE-2025-67268 Denial of Service
Security fixes for CVE-2025-67268 and CVE-2025-67269.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-2ca69451b9 2026-01-15 01:11:51.080180+00:00 -------------------------------------------------------------------------------- Name : gpsd Product : Fedora 43 Version : 3.26.1 Release : 6.fc43 URL : https://gpsd.gitlab.io/gpsd/index.html Summary : Service daemon for mediating access to a GPS Description : gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. -------------------------------------------------------------------------------- Update Information: Security fixes for CVE-2025-67268 and CVE-2025-67269. -------------------------------------------------------------------------------- ChangeLog: * Mon Jan 12 2026 Miroslav Lichvar - 1:3.26.1-6 - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2426827 - CVE-2025-67269 gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2426827 [ 2 ] Bug #2426828 - CVE-2025-67269 gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2426828 [ 3 ] Bug #2426932 - CVE-2025-67268 gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds writein NMEA2000 packet handling [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2426932 [ 4 ] Bug #2426933 - CVE-2025-67268 gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2426933 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2ca69451b9' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jan 15, 2026
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!