{"id":"CVE-2026-99049","title":"gpio: xilinx: fix runtime PM leak on request error path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: xilinx: fix runtime PM leak on request error path\n\npm_runtime_get_sync() leaves the usage counter incremented even when it\nfails, and xgpio_request() returns the …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < b07b3925f676640103b3d74b93fc401b1c873d13","Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < f73ee2bd2293f8cc340061c5229395ace71fc2eb","Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < a027e0d7765d1531ee39e4dae81951b04f32ba7b","Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < 2fd6ecda5d1f47cffcfadddb35ee49402162c724","Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < ff82fc3a4a1d417dee1229681cc5285986edb1fa","Linux 5.12"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:22:26.409Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99049","references":[{"url":"https://git.kernel.org/stable/c/b07b3925f676640103b3d74b93fc401b1c873d13"},{"url":"https://git.kernel.org/stable/c/f73ee2bd2293f8cc340061c5229395ace71fc2eb"},{"url":"https://git.kernel.org/stable/c/a027e0d7765d1531ee39e4dae81951b04f32ba7b"},{"url":"https://git.kernel.org/stable/c/2fd6ecda5d1f47cffcfadddb35ee49402162c724"},{"url":"https://git.kernel.org/stable/c/ff82fc3a4a1d417dee1229681cc5285986edb1fa"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.524Z","slug":"CVE-2026-99049","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngpio: xilinx: fix runtime PM leak on request error path\n\npm_runtime_get_sync() leaves the usage counter incremented even when it\nfails, and xgpio_request() returns the error without dropping it.\n\ngpiolib does not call ->free() when ->request() fails, so xgpio_free(),\nwhich holds the only matching pm_runtime_put(), never runs. The reference\nis leaked and the controller can no longer runtime-suspend, so its clock\nstays enabled.\n\nSwitch to pm_runtime_resume_and_get(), which only increments the usage\ncounter on success.\n\n## Affected\n\n- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < b07b3925f676640103b3d74b93fc401b1c873d13`\n- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < f73ee2bd2293f8cc340061c5229395ace71fc2eb`\n- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < a027e0d7765d1531ee39e4dae81951b04f32ba7b`\n- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < 2fd6ecda5d1f47cffcfadddb35ee49402162c724`\n- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < ff82fc3a4a1d417dee1229681cc5285986edb1fa`\n- `Linux 5.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}