In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync()… (CVE-2026-99049)

The Linux kernel's Xilinx GPIO driver had a flaw where pm_runtime_get_sync() would increment the runtime PM usage counter even if it failed, and the xgpio_request() function would return the error without decrementing the counter. Since the gpiolib does not call the free function on request failure, the corresponding pm_runtime_put() call in xgpio_free() never occurs, causing a reference leak. This leak prevents the controller from runtime-suspending, leaving its clock enabled and potentially wasting power. The vulnerability was resolved by changing the code to use pm_runtime_resume_and_get(), which increments the usage counter only upon success, preventing the leak.

The vulnerability causes a runtime power management reference leak in the Xilinx GPIO driver, which prevents the controller from entering runtime suspend state. This results in the controller's clock remaining enabled unnecessarily, potentially leading to increased power consumption. There is no indication of direct security compromise or code execution impact.

A fix is available that changes the driver to use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() to avoid incrementing the usage counter on failure. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level fix, updating to the patched kernel version is the recommended remediation.