CVE-2025-67268: 
NixOS vulnerability analysis and mitigation

CVE-2025-67268 is a heap-based out-of-bounds write vulnerability in gpsd's NMEA2000 driver that can lead to memory corruption, Denial of Service, and potentially arbitrary code execution. The flaw exists in the hnd_129540 function within drivers/driver_nmea2000.c, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets without validating the user-supplied satellite count against the fixed-size skyview array (184 elements / MAXCHANNELS). All gpsd versions prior to 3.27.1 are affected. The CVE was assigned on December 17, 2025, publicly disclosed on January 2, 2026, and patched via commit dc966aa. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper validation of a user-controlled index before using it to write into a fixed-size heap array (CWE-122: Heap-based Buffer Overflow; CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input). In the vulnerable code, session->gpsdata.satellites_visible is directly assigned from bu[2] — a single byte from the incoming NMEA2000 packet — without any bounds check against MAXCHANNELS (184). A subsequent loop iterates up to 255 times, writing satellite data (elevation, azimuth, SNR, PRN) into session->gpsdata.skyview[], overflowing the heap buffer by up to 71 entries. The fix in commit dc966aa clamps satellites_visible to MAXCHANNELS and adds a packet length validation before processing (gpsd Commit, PoC README).

Successful exploitation can result in heap memory corruption adjacent to the skyview array, causing the gpsd daemon to crash (Denial of Service) or enter an inconsistent state where it can no longer serve GPS clients. In more severe scenarios, depending on heap layout and adjacent objects, an attacker may achieve arbitrary code execution with the privileges of the gpsd process, potentially enabling confidentiality and integrity breaches on the affected system. Systems relying on gpsd for navigation or timing — including maritime, automotive, and IoT platforms — are at risk of service disruption or compromise (Red Hat Bugzilla, PoC README).

A public proof-of-concept (PoC) is available on GitHub, published by researcher Jaehyun Lee, though full exploit code was withheld for responsible disclosure at the time of initial publication (PoC README). No evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires no authentication and no user interaction, with network-accessible attack vector and low complexity, making it highly exploitable in environments where gpsd's NMEA2000 interface is reachable. The EPSS score is 0.017% (low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA KEV catalog (Red Hat Advisory).

1. Reconnaissance: Identify systems running gpsd with NMEA2000 support enabled (versions prior to 3.27.1) on a CAN bus network or accessible network segment. Tools like network scanners or CAN bus analyzers can help identify reachable gpsd instances.
2. Craft malicious PGN 129540 packet: Construct a NMEA2000 Fast Packet for PGN 129540 (GNSS Satellites in View) where the satellite count byte at offset 2 (bu[2]) is set to 0xFF (255), far exceeding the MAXCHANNELS limit of 184.
3. Inject the packet: Transmit the crafted packet over the CAN bus (NMEA2000 network) or via any network path that delivers NMEA2000 data to the gpsd daemon. No authentication is required.
4. Trigger heap overflow: The hnd_129540 function processes the packet, assigns satellites_visible = 255, and iterates the loop 255 times, writing satellite data (elevation, azimuth, SNR, PRN) beyond the skyview array boundary, corrupting adjacent heap memory.
5. Achieve objective: Depending on heap layout, the overflow may crash the gpsd process (DoS) or, with heap grooming techniques, overwrite adjacent heap objects to redirect execution flow and achieve arbitrary code execution with gpsd process privileges (PoC README, gpsd Commit).

• Logs: gpsd log entries containing warnings such as pgn 129540: Too many sats 255 (present in patched versions; absence of this warning on unpatched systems processing oversized packets is notable); unexpected gpsd process crashes or restarts in system logs (/var/log/syslog, journalctl).
• Process: Unexpected termination or restart of the gpsd daemon; child processes spawned by gpsd (e.g., shell processes) that are not part of normal operation.
• Network/CAN Bus: NMEA2000 PGN 129540 packets with satellite count byte (bu[2]) set to values greater than 184 (0xB8), particularly 255 (0xFF); anomalous or malformed Fast Packet sequences on the CAN bus targeting PGN 129540.
• File System: Unexpected files or modified binaries in gpsd installation directories; core dump files (core, gpsd.core) generated by gpsd crashes.

Upgrade gpsd to version 3.27.1 or later, which includes the fix introduced in commit dc966aa that clamps the satellite count to MAXCHANNELS and validates packet length before processing (gpsd Commit). Red Hat has issued patches for RHEL 9 (RHSA-2026:0771), RHEL 10 (RHSA-2026:0770), and RHEL 10.0 EUS (RHSA-2026:1621); Ubuntu has issued USN-7948-1; Debian has issued DLA-4441-1; and Fedora and Mageia have also released updated packages (Red Hat Bugzilla, Ubuntu Advisory). For systems that cannot be patched immediately, restrict network and CAN bus access to the gpsd service, disable NMEA2000 packet handling if not operationally required, and monitor for anomalous packet patterns or gpsd crashes.

Red Hat classified the vulnerability as high severity and issued multiple errata (RHSA-2026:0770, RHSA-2026:0771, RHSA-2026:1621) within weeks of disclosure (Red Hat Bugzilla). Multiple Linux distributions including Ubuntu, Debian, Fedora, openSUSE, AlmaLinux, Oracle Linux, and Mageia issued security advisories and updated packages. The vulnerability received coverage from Linux security news aggregators and German security outlet Pro-Linux, which published multiple articles on the issue.