Answer in brief
CVE-2026-99049 records a Unknown severity vulnerability in gpio: xilinx: fix runtime PM leak on request error path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=26b04774621ed333e8bc56479feb6e31625df58c <b07b3925f676640103b3d74b93fc401b1c873d13 || >=26b04774621ed333e8bc56479feb6e31625df58c <f73ee2bd2293f8cc340061c5229395ace71fc2eb || >=26b04774621ed333e8bc56479feb6e31625df58c <a027e0d7765d1531ee39e4dae81951b04f32ba7b || >=26b04774621ed333e8bc56479feb6e31625df58c <2fd6ecda5d1f47cffcfadddb35ee49402162c724 || >=26b04774621ed333e8bc56479feb6e31625df58c <ff82fc3a4a1d417dee1229681cc5285986edb1fa | b07b3925f676640103b3d74b93fc401b1c873d13, f73ee2bd2293f8cc340061c5229395ace71fc2eb, a027e0d7765d1531ee39e4dae81951b04f32ba7b, 2fd6ecda5d1f47cffcfadddb35ee49402162c724, ff82fc3a4a1d417dee1229681cc5285986edb1fa |
| Linux/Linuxgeneric | 5.12 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.
Quoted source text, attributed separately from HOL analysis.