gpsd: patch CVE-2026-60122

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122

(cherry picked from commit da527bb6ba)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch

@@ -0,0 +1,45 @@
+From 50bf98d0240b94bbec6ce06be33cdaf99e2f6214 Mon Sep 17 00:00:00 2001
+From: "Gary E. Miller" <gem@rellim.com>
+Date: Mon, 20 Jul 2026 20:12:16 -0700
+Subject: [PATCH] clients/gpsprof.py.in: ensure sats.used is boolean.  Issue
+ 406
+
+Prevfent command injection by sates.used.  Force to boolean.
+
+(cherry picked from commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93)
+
+CVE: CVE-2026-60122
+Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ clients/gpsprof.py.in | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index e91367ee3..07123d417 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -334,8 +334,11 @@ class spaceplot(plotter):
+             # get sat used count
+             sats_used = 0
+             for sat in self.session.satellites:
+-                if sat.used:
++                if sat.used is True:
+                     sats_used += 1
++                else:
++                    # ensure it is boolean.
++                    sat.used = False
+ 
+             if 'altHAE' not in self.session.data:
+                 self.session.data['altHAE'] = gps.NaN
+@@ -783,6 +786,10 @@ class polarplot(plotter):
+                     used += 1
+                     if 'polarunused' == self.name:
+                         continue
++                else:
++                    # ensure it is boolean.
++                    sat['used'] = False;
++
+                 if (('polarused' == self.name and
+                      sat['used'] is False)):
+                     continue

meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb

@@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \
            file://CVE-2026-58459-1.patch \
            file://CVE-2026-58459-2.patch \
            file://CVE-2026-58459-3.patch \
+           file://CVE-2026-60122.patch \
            file://gpsd.init \
            "
 SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649"