CVE-2026-99049

gpio: xilinx: fix runtime PM leak on request error path

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: fix runtime PM leak on request error path

pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it.

gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled.

Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	26b04774621ed333e8bc56479feb6e31625df58c to before 3c7c764a3e933b4b32a847edeb89c8d1930613f4Affected 26b04774621ed333e8bc56479feb6e31625df58c to before 7fa0e73dc31f4e653918fc002d64909c83f4b020Affected 26b04774621ed333e8bc56479feb6e31625df58c to before b07b3925f676640103b3d74b93fc401b1c873d13Affected 26b04774621ed333e8bc56479feb6e31625df58c to before f73ee2bd2293f8cc340061c5229395ace71fc2ebAffected 26b04774621ed333e8bc56479feb6e31625df58c to before a027e0d7765d1531ee39e4dae81951b04f32ba7bAffected 26b04774621ed333e8bc56479feb6e31625df58c to before 2fd6ecda5d1f47cffcfadddb35ee49402162c724Affected 26b04774621ed333e8bc56479feb6e31625df58c to before ff82fc3a4a1d417dee1229681cc5285986edb1faAffected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

26b04774621ed333e8bc56479feb6e31625df58c to before 3c7c764a3e933b4b32a847edeb89c8d1930613f4Affected
26b04774621ed333e8bc56479feb6e31625df58c to before 7fa0e73dc31f4e653918fc002d64909c83f4b020Affected
26b04774621ed333e8bc56479feb6e31625df58c to before b07b3925f676640103b3d74b93fc401b1c873d13Affected
26b04774621ed333e8bc56479feb6e31625df58c to before f73ee2bd2293f8cc340061c5229395ace71fc2ebAffected
26b04774621ed333e8bc56479feb6e31625df58c to before a027e0d7765d1531ee39e4dae81951b04f32ba7bAffected
26b04774621ed333e8bc56479feb6e31625df58c to before 2fd6ecda5d1f47cffcfadddb35ee49402162c724Affected
26b04774621ed333e8bc56479feb6e31625df58c to before ff82fc3a4a1d417dee1229681cc5285986edb1faAffected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.