CVE-2026-98527

Received Received - Intake

Runtime PM Leak in Zynq GPIO Kernel Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and zynq_gpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, so zynq_gpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98527

EUVD

EUVD-2026-103572

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52
Linux	Linux	3.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's GPIO subsystem for Zynq devices. It involves a runtime power management (PM) leak where pm_runtime_get_sync() increments a usage counter even when it fails. The zynq_gpio_request() function returns an error without decrementing this counter, causing the reference to leak. This prevents the controller from runtime-suspending, keeping its clock enabled indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's GPIO subsystem for Zynq devices. Detection requires checking the kernel version and examining the gpio-zynq driver for the runtime PM leak. Use uname -a to check the kernel version and grep for the affected driver in /proc/modules or dmesg logs.

Impact Analysis

The impact includes increased power consumption due to the clock remaining enabled, potential system instability from improper resource management, and possible degradation of performance if the affected controller is critical to system operation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a runtime power management issue in the Linux kernel's GPIO subsystem for Zynq devices, causing a clock to remain enabled due to a reference counter leak. Compliance impacts would only occur if this issue indirectly affects data protection or system integrity in a specific implementation.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the gpio-zynq driver. If an update is unavailable, disable runtime PM for the affected GPIO controller or avoid using the zynq GPIO driver until patched.

Hi! I’m here to help you understand CVE-2026-98527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70