Live › vulnerability › CVE-2026-99049
Go to dashboardIn the Linux kernel's Xilinx GPIO driver, a failed request leaves the runtime power-management usage counter raised, because the matching release never runs. The controller then cannot runtime-suspend and its clock stays enabled, which wastes power and can stall power management rather than giving an attacker code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Xilinx GPIO driver on Xilinx/AMD platforms that use runtime power management for that GPIO controller. Systems without Xilinx GPIO hardware or with a patched kernel can skip it. The sources do not say which kernel versions are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
gpio: xilinx: fix runtime PM leak on request error path
pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it.
gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled.
Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.
This page as .md · .json · in your agent: get_signal("CVE-2026-99049")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.