Description
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpsd | 3.27.5-0.1 | — |
| Debian 13 | gpsd | 3.25-5+deb13u1 | — |
| Debian 12 | gpsd | 3.22-4.1+deb12u1 | — |
| Debian 11 | gpsd | 3.22-4+deb11u1 | DLA-4441-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gpsd | 3.27-1.1ubuntu1 | — |
| Ubuntu 25.10 | gpsd | 3.25-5ubuntu1.25.10.1 | — |
| Ubuntu 24.04 LTS | gpsd | 3.25-3ubuntu3.2 | — |
| Ubuntu 22.04 LTS | gpsd | 3.22-4ubuntu2.1 | — |
| Ubuntu 20.04 LTS | gpsd | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | gpsd | No fix yet | — |
| Ubuntu 16.04 LTS | gpsd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gpsd +2 | 1:3.26.1-1.el10_1.1 | RHSA-2026:0770 |
| RHEL 9 | gpsd-minimal +1 | 1:3.26.1-1.el9_7.1 | RHSA-2026:0771 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gpsd +2 | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| AlmaLinux 9 | gpsd-minimal +1 | 1:3.26.1-1.el9_7.1 | ALSA-2026:0771 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gpsd | 1:3.26.1-1.el10_1.1 | RLSA-2026:0770 |
| Rocky Linux 9 | gpsd-minimal | 1:3.26.1-1.el9_7.1 | RLSA-2026:0771 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gpsd | 3.27.3-1.1 | openSUSE-SU-2026:10008-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gpsd +2 | 1:3.26.1-1.0.1.el10_1.1 | ELSA-2026-0770 |
| Oracle Linux 9 | gpsd-minimal +1 | 1:3.26.1-1.0.1.el9_7.1 | ELSA-2026-0771 |
Advisories 11
- ALSA-2026:0770 Important: gpsd security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0771 Important: gpsd-minimal security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-0138 Red Hat Enterprise Linux (gpsd): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- RHSA-2026:0771 Red Hat Security Advisory: gpsd-minimal security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:0770 Red Hat Security Advisory: gpsd security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- openSUSE-SU-2026:10008-1 gpsd-3.27.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2026:0770 Important: gpsd security update Rocky Linux Security Advisories · Jan 21, 2026
- RLSA-2026:0771 Important: gpsd-minimal security update Rocky Linux Security Advisories · Jan 20, 2026
- DLA-4441-1 gpsd - security update Debian Security (DSA / DLA) · Jan 19, 2026
- ELSA-2026-0770 Important: gpsd security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jan 19, 2026
- ELSA-2026-0771 Important: gpsd-minimal security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 19, 2026