Junglewise Threat Intelligence

CVE-2025-67269: gpsd integer underflow in NAVCOM packet parsing

CVE-2025-67269 · Severity: high · CVSS 7.5 · Published 2026-01-02

Technologies: Red Hat Enterprise Linux AppStream, Gpsd Project Gpsd. Vendors: Red Hat, Gpsd Project.

Executive brief

A vulnerability in the gpsd service, which manages GPS and navigation sensors, can allow an attacker to crash the service or make it unresponsive. By sending a specially crafted navigation packet, an attacker can force the system to consume 100% of its processing power, leading to a denial of service. This could disrupt operations for any application relying on precise location or timing data from the affected system.

Technical details

An integer underflow exists in the nextstate() function within gpsd/packet.c when handling NAVCOM_ID states. The vulnerability occurs because the lexer calculates the payload length by subtracting 4 from an input byte without verifying if the byte is at least 4. If the byte is smaller, an unsigned integer underflow occurs, resulting in a length value near SIZE_MAX. The parser then enters a loop attempting to consume this massive amount of data, leading to 100% CPU utilization and a permanent hang of the daemon. This can be triggered via any input channel supported by gpsd, including network sockets (TCP port 2947) or local serial devices. The issue is fixed in version 3.27.1.

Affected products

  • gpsd project gpsd versions prior to 3.27.1
  • Red Hat Red Hat Enterprise Linux AppStream (v. 9) affected
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) affected

Timeline

  • 2025-12-03: patched: Commit ffa1d6f40bca0b035fc7f5e563160ebb67199da7 merged to fix the underflow.
  • 2026-01-02: disclosed: Public disclosure of CVE-2025-67269.
  • 2026-01-19: advisory: Red Hat issued security advisory RHSA-2026:0770.

References

Related threats