CVE-2025-67269: 
NixOS vulnerability analysis and mitigation

CVE-2025-67269 is an integer underflow vulnerability in the nextstate() function within gpsd/packet.c of the gpsd GPS daemon, affecting all versions prior to 3.27.1. When parsing a NAVCOM packet, the payload length is calculated as lexer->length = (size_t)c - 4 without validating that the input byte c is at least 4, causing an unsigned integer underflow that sets lexer->length to a value near SIZE_MAX. This triggers a CPU-exhausting loop and results in a Denial of Service (DoS) condition. The vulnerability was discovered in 2025, assigned CVE on December 17, 2025, and publicly disclosed on January 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub PoC).

The root cause is classified as CWE-191 (Integer Underflow / Wrap or Wraparound). In the NAVCOM_ID state of the packet state machine in gpsd/packet.c, the code performs lexer->length = (size_t)c - 4 where c is an unsigned byte read from the incoming packet. If c is 0, 1, 2, or 3, the subtraction wraps around to a value near SIZE_MAX due to unsigned integer arithmetic. The parser then enters a loop attempting to consume that enormous number of bytes, pinning the CPU at 100%. Exploitation requires no authentication and can be triggered remotely over any network port gpsd is listening on, or locally via a serial device. A public PoC describing the packet structure (0x02 0x99 0x66 0x00) is available (GitHub PoC, Red Hat Bugzilla).

Successful exploitation causes 100% CPU utilization in the gpsd daemon, rendering it unable to serve GPS data to any connected clients until the process is restarted. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Systems relying on gpsd for navigation, timing, or location services (including NTP servers using GPS as a time source) would be disrupted for the duration of the attack (GitHub PoC, Red Hat Advisory).

A public proof-of-concept is available on GitHub describing the malicious packet structure needed to trigger the underflow, though full exploit code was withheld for responsible disclosure. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub PoC, Red Hat Advisory).

1. Reconnaissance: Identify hosts running gpsd and determine whether the service is network-accessible (default port 2947/TCP) using tools like Nmap (nmap -sV -p 2947 <target>) or Shodan.
2. Craft malicious NAVCOM packet: Construct a packet with the NAVCOM header bytes 0x02 (STX), 0x99 (TM), 0x66 (ID check), followed by 0x00 as the ID byte — a value less than 4 that will trigger the underflow when the parser reaches the NAVCOM_ID state.
3. Deliver the packet: Send the crafted packet to the gpsd network port (TCP 2947) or inject it via a serial device interface if only local access is available.
4. Trigger underflow: The parser reads c = 0x00, computes lexer->length = (size_t)0 - 4, which wraps to near SIZE_MAX due to unsigned integer arithmetic.
5. Achieve DoS: The parser enters a loop attempting to consume ~SIZE_MAX bytes, causing 100% CPU utilization and making gpsd unresponsive to all clients until the process is manually restarted (GitHub PoC).

• Network: Unexpected TCP connections to port 2947 from untrusted or external IP addresses; repeated short packets with NAVCOM header bytes (0x02 0x99 0x66) followed by a byte value less than 0x04.
• Process: gpsd process consuming 100% of a CPU core continuously; top or ps showing gpsd stuck in a tight loop with no normal GPS data output.
• Logs: System logs (/var/log/syslog, journalctl -u gpsd) showing gpsd becoming unresponsive or clients timing out; absence of normal NMEA/GPS output from gpsd after the event.
• File System: No file-based artifacts expected, as this is a pure DoS with no code execution component.

Upgrade gpsd to version 3.27.1 or later, which includes the fix introduced in commit ffa1d6f40bca0b035fc7f5e563160ebb67199da7 that adds a boundary check before the subtraction. Vendor patches have been issued for Red Hat Enterprise Linux 9 (RHSA-2026:0771), RHEL 10 (RHSA-2026:0770), Ubuntu (USN-7948-1), Debian LTS (DLA-4441-1), Fedora, AlmaLinux, Oracle Linux, and Mageia. As a temporary workaround where patching is not immediately possible, restrict network access to gpsd's port (default 2947/TCP) using firewall rules to limit exposure to trusted hosts only (Red Hat Bugzilla, Red Hat Advisory, Ubuntu Advisory).

Red Hat rated the vulnerability as high severity and issued security errata for both RHEL 9 and RHEL 10 within approximately two weeks of disclosure. Multiple Linux distributions including Ubuntu, Debian, Fedora, AlmaLinux, Oracle Linux, and Mageia issued security advisories and updated packages. The vulnerability was detected by both Nessus and Qualys scanners shortly after disclosure, indicating rapid integration into vulnerability management tooling. No notable social media controversy or researcher debate has been observed beyond standard advisory coverage (Red Hat Advisory, Ubuntu Advisory).