Back Linuxsecurity

Fedora 42: gpsd Critical Buffer Overflow & DoS CVE-2025

Linuxsecurity •LinuxSecurity Advisories • January 20, 2026

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Update Information : Security fixes for CVE-2025-67268 and CVE-2025-67269.

gpsd is a service daemon that mediates access to a GPS sensor

connected to the host computer by serial or USB interface, making its

data on the location/course/velocity of the sensor available to be

queried on TCP port 2947 of the host computer. With gpsd, multiple

GPS client applications (such as navigational and war-driving software)

can access to a GPS without contention or loss of data. Also,

gpsd responds to queries with a format that is substantially easier to

parse than NMEA 0183.

Security fixes for CVE-2025-67268 and CVE-2025-67269.

* Mon Jan 12 2026 Miroslav Lichvar - 1:3.25-17 - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269)

[ 1 ] Bug #2426827 - CVE-2025-67269 gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing [fedora-42] [ 2 ] Bug #2426828 - CVE-2025-67269 gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing [fedora-43] [ 3 ] Bug #2426932 - CVE-2025-67268 gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling [fedora-42] [ 4 ] Bug #2426933 - CVE-2025-67268 gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-a1552b48c3' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow Vulnerability in gpsd Affects Fedora 42 and 43 A critical buffer overflow vulnerability (CVE-2025) was identified in gpsd, a daemon that facilitates access to GPS sensors on Fedora systems. This vulnerability affects users of Fedora 42 and 43, allowing potential denial of service and unauthorized access to GPS data. Users are advised to apply security updates to mitigate the risks associated with this vulnerability. 2 sources 35

Extracted Entities

Fedora 42: gpsd Critical Buffer Overflow & DoS CVE-2025

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Platforms (1)