Vulnerability · Published Jan 2, 2026 · Assigned by mitre
CVE-2025-67269
High 7.5
In plain English
A high-severity security flaw in the gpsd package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | gpsd | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| AlmaLinux:10 | gpsd-clients | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| AlmaLinux:9 | gpsd-minimal | 1:3.26.1-1.el9_7.1 | ALSA-2026:0771 |
| AlmaLinux:9 | gpsd-minimal-clients | 1:3.26.1-1.el9_7.1 | ALSA-2026:0771 |
| AlmaLinux:10 | python3-gpsd | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| Debian:12 | gpsd | 3.22-4.1+deb12u1 | DEBIAN-CVE-2025-67269 |
| Debian:13 | gpsd | 3.25-5+deb13u1 | DEBIAN-CVE-2025-67269 |
| Debian:14 | gpsd | 3.27.5-0.1 | DEBIAN-CVE-2025-67269 |
| Rocky Linux:10 | gpsd | 1:3.26.1-1.el10_1.1 | RLSA-2026:0770 |
| Rocky Linux:9 | gpsd-minimal | 1:3.26.1-1.el9_7.1 | RLSA-2026:0771 |
| Ubuntu:22.04:LTS | gpsd | 3.22-4ubuntu2.1 | UBUNTU-CVE-2025-67269 |
| Ubuntu:24.04:LTS | gpsd | 3.25-3ubuntu3.2 | UBUNTU-CVE-2025-67269 |
| Ubuntu:25.10 | gpsd | 3.25-5ubuntu1.25.10.1 | UBUNTU-CVE-2025-67269 |
| Ubuntu:26.04:LTS | gpsd | 3.27-1.1ubuntu1 | UBUNTU-CVE-2025-67269 |
Affected products (as reported)
Weakness: CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7
- https://gitlab.com/gpsd/gpsd
- https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67269/README.md
- https://access.redhat.com/security/cve/CVE-2025-67269 vdb-entry, x_refsource_REDHAT
- RHBZ#2426810 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67269.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:0770 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:0771 vendor-advisory, x_refsource_REDHAT