CVE-2026-99049

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-99049
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99049.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-99049
Downstream
Related
Published
2026-10-23T12:22:26Z
Modified
2026-11-06T17:27:13Z
Summary
gpio: xilinx: fix runtime PM leak on request error path
Details

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: fix runtime PM leak on request error path

pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it.

gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled.

Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99049.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
26b04774621ed333e8bc56479feb6e31625df58c
Fixed
3c7c764a3e933b4b32a847edeb89c8d1930613f4
Fixed
7fa0e73dc31f4e653918fc002d64909c83f4b020
Fixed
b07b3925f676640103b3d74b93fc401b1c873d13
Fixed
f73ee2bd2293f8cc340061c5229395ace71fc2eb
Fixed
a027e0d7765d1531ee39e4dae81951b04f32ba7b
Fixed
2fd6ecda5d1f47cffcfadddb35ee49402162c724
Fixed
ff82fc3a4a1d417dee1229681cc5285986edb1fa

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99049.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.12.0
Fixed
5.15.224
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.113
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.57
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.11

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99049.json"