CVE-2026-99049
NoneCVSS
—
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
Cloudanix analysis
A small error-handling mistake in the Linux kernel can stop certain hardware controllers from turning off when they should, causing devices to use more power than necessary.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Other
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Runtime PM reference leak in Xilinx GPIO driver: pm_runtime_get_sync failure in xgpio_request leaves usage counter incremented, and gpiolib skips ->free so xgpio_free never decrements it, preventing runtime suspend and keeping the clock enabled.
Why it matters to the business
Affected Linux systems experience unnecessary power draw and inability to suspend GPIO controllers after GPIO request errors, increasing energy costs and reducing battery life on embedded or mobile deployments.
How an attack unfolds
No known malicious exploitation path exists; the defect triggers automatically on any error return from xgpio_request without requiring attacker interaction.
How to fix it
Apply the upstream fix that replaces pm_runtime_get_sync with pm_runtime_resume_and_get in the Xilinx GPIO request path; rebuild and deploy the patched kernel on all affected systems.
How to confirm the fix worked
Confirm the commit introducing pm_runtime_resume_and_get is present in the running kernel source or binary; test that GPIO request failures no longer prevent subsequent runtime suspend of the controller.
How to detect it
Examine kernel logs for repeated GPIO request failures followed by absence of runtime suspend events for the Xilinx controller; no post-exploitation artifacts are expected.
What your security team should do
- Prioritize kernel upgrade on any system using the xilinx GPIO driver within the next maintenance window due to the recent publication.
- Monitor power and suspend behavior on embedded devices after applying the patch.
- Review GPIO usage in device trees or drivers for error paths that could trigger the leak.
The record
In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|