AZL-110927: CVE-2026-99049 affecting package kernel 6.6.157.1-1

Q: Which systems are exposed to this issue?

Systems using the Xilinx GPIO driver are exposed when a GPIO request reaches the driver's error path. The issue is specific to the runtime power-management handling in that driver.

Q: What is the practical impact if the error path is triggered?

A failed runtime PM get can leave a usage reference leaked because the matching release path is not called. The GPIO controller may then be unable to runtime-suspend, leaving its clock enabled.

Q: Does exploitation require an attacker to successfully obtain a GPIO?

No. The described leak occurs when the GPIO request fails after the runtime PM operation increments its usage counter. The data does not identify a remote attack path or specific attacker prerequisites.

Q: What is the remediation?

Use the resolved implementation that replaces pm_runtime_get_sync() with pm_runtime_resume_and_get() in the Xilinx GPIO request path. The latter increments the runtime PM usage counter only when the operation succeeds.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: fix runtime PM leak on request error path

pmruntimegetsync() leaves the usage counter incremented even when it fails, and xgpiorequest() returns the error without dropping it.

gpiolib does not call ->free() when ->request() fails, so xgpiofree(), which holds the only matching pmruntimeput(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled.

Switch to pmruntimeresumeandget(), which only increments the usage counter on success.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 23, 2026

Advisory Published

via OSV·01:17 PM

Data Sourced

via OSV·01:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99049

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Xilinx GPIO driver are exposed when a GPIO request reaches the driver's error path. The issue is specific to the runtime power-management handling in that driver.

What is the practical impact if the error path is triggered?

A failed runtime PM get can leave a usage reference leaked because the matching release path is not called. The GPIO controller may then be unable to runtime-suspend, leaving its clock enabled.

Does exploitation require an attacker to successfully obtain a GPIO?

No. The described leak occurs when the GPIO request fails after the runtime PM operation increments its usage counter. The data does not identify a remote attack path or specific attacker prerequisites.

What is the remediation?

Use the resolved implementation that replaces pm_runtime_get_sync() with pm_runtime_resume_and_get() in the Xilinx GPIO request path. The latter increments the runtime PM usage counter only when the operation succeeds.

AZL-110927: CVE-2026-99049 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this issue?

What is the practical impact if the error path is triggered?

Does exploitation require an attacker to successfully obtain a GPIO?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What is the practical impact if the error path is triggered?

Does exploitation require an attacker to successfully obtain a GPIO?

What is the remediation?