Description
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpsd | 3.27.5-0.1 | — |
| Debian 13 | gpsd | 3.25-5+deb13u1 | — |
| Debian 12 | gpsd | 3.22-4.1+deb12u1 | — |
| Debian 11 | gpsd | 3.22-4+deb11u1 | DLA-4441-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gpsd | 3.27-1.1ubuntu1 | — |
| Ubuntu 25.10 | gpsd | 3.25-5ubuntu1.25.10.1 | — |
| Ubuntu 24.04 LTS | gpsd | 3.25-3ubuntu3.2 | — |
| Ubuntu 22.04 LTS | gpsd | 3.22-4ubuntu2.1 | — |
| Ubuntu 20.04 LTS | gpsd | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | gpsd | No fix yet | — |
| Ubuntu 16.04 LTS | gpsd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gpsd +2 | 1:3.26.1-1.el10_1.1 | RHSA-2026:0770 |
| RHEL 9 | gpsd-minimal +1 | 1:3.26.1-1.el9_7.1 | RHSA-2026:0771 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gpsd +2 | 1:3.25-17.el10_0.1 | RHSA-2026:1621 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gpsd +2 | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| AlmaLinux 9 | gpsd-minimal +1 | 1:3.26.1-1.el9_7.1 | ALSA-2026:0771 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gpsd | 1:3.26.1-1.el10_1.1 | RLSA-2026:0770 |
| Rocky Linux 9 | gpsd-minimal | 1:3.26.1-1.el9_7.1 | RLSA-2026:0771 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gpsd | 3.27.3-1.1 | openSUSE-SU-2026:10008-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gpsd +2 | 1:3.26.1-1.0.1.el10_1.1 | ELSA-2026-0770 |
| Oracle Linux 9 | gpsd-minimal +1 | 1:3.26.1-1.0.1.el9_7.1 | ELSA-2026-0771 |
Advisories 12
- ALSA-2026:0770 Important: gpsd security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0771 Important: gpsd-minimal security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-0138 Red Hat Enterprise Linux (gpsd): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- RHSA-2026:1621 Red Hat Security Advisory: gpsd security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:0771 Red Hat Security Advisory: gpsd-minimal security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:0770 Red Hat Security Advisory: gpsd security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- openSUSE-SU-2026:10008-1 gpsd-3.27.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2026:0770 Important: gpsd security update Rocky Linux Security Advisories · Jan 21, 2026
- RLSA-2026:0771 Important: gpsd-minimal security update Rocky Linux Security Advisories · Jan 20, 2026
- DLA-4441-1 gpsd - security update Debian Security (DSA / DLA) · Jan 19, 2026
- ELSA-2026-0770 Important: gpsd security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jan 19, 2026
- ELSA-2026-0771 Important: gpsd-minimal security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 19, 2026