---
id: CVE-2026-99049
title: 'gpio: xilinx: fix runtime PM leak on request error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gpio: xilinx: fix runtime PM leak on request error path

  pm_runtime_get_sync() leaves the usage counter incremented even when it
  fails, and xgpio_request() returns the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 26b04774621ed333e8bc56479feb6e31625df58c <
    b07b3925f676640103b3d74b93fc401b1c873d13
  - >-
    Linux >= 26b04774621ed333e8bc56479feb6e31625df58c <
    f73ee2bd2293f8cc340061c5229395ace71fc2eb
  - >-
    Linux >= 26b04774621ed333e8bc56479feb6e31625df58c <
    a027e0d7765d1531ee39e4dae81951b04f32ba7b
  - >-
    Linux >= 26b04774621ed333e8bc56479feb6e31625df58c <
    2fd6ecda5d1f47cffcfadddb35ee49402162c724
  - >-
    Linux >= 26b04774621ed333e8bc56479feb6e31625df58c <
    ff82fc3a4a1d417dee1229681cc5285986edb1fa
  - Linux 5.12
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:22:26.409Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99049'
references:
  - url: 'https://git.kernel.org/stable/c/b07b3925f676640103b3d74b93fc401b1c873d13'
  - url: 'https://git.kernel.org/stable/c/f73ee2bd2293f8cc340061c5229395ace71fc2eb'
  - url: 'https://git.kernel.org/stable/c/a027e0d7765d1531ee39e4dae81951b04f32ba7b'
  - url: 'https://git.kernel.org/stable/c/2fd6ecda5d1f47cffcfadddb35ee49402162c724'
  - url: 'https://git.kernel.org/stable/c/ff82fc3a4a1d417dee1229681cc5285986edb1fa'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.524Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: fix runtime PM leak on request error path

pm_runtime_get_sync() leaves the usage counter incremented even when it
fails, and xgpio_request() returns the error without dropping it.

gpiolib does not call ->free() when ->request() fails, so xgpio_free(),
which holds the only matching pm_runtime_put(), never runs. The reference
is leaked and the controller can no longer runtime-suspend, so its clock
stays enabled.

Switch to pm_runtime_resume_and_get(), which only increments the usage
counter on success.

## Affected

- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < b07b3925f676640103b3d74b93fc401b1c873d13`
- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < f73ee2bd2293f8cc340061c5229395ace71fc2eb`
- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < a027e0d7765d1531ee39e4dae81951b04f32ba7b`
- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < 2fd6ecda5d1f47cffcfadddb35ee49402162c724`
- `Linux >= 26b04774621ed333e8bc56479feb6e31625df58c < ff82fc3a4a1d417dee1229681cc5285986edb1fa`
- `Linux 5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.