CVE-2026-98527gpio: zynq: fix runtime PM leak on request error path
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and zynq_gpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, so zynq_gpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < e380fba02908b809f5bbef371259003cf5887bb4
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < a3e9b7f7c9558f8c9592f8f817557bff98707bb3
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < 60a76cdd92e25f576dc58d756a565760dde1f7a1
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < 25c08be2a5e7715f19a6e02bbe9b0e5f01c77aac
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < 6e05f1c614a57a5d4c364dd12e20c6fd012f9d3e
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < 58a417a19d80141fff3abe6004e2e47285506e73
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < 6e20dabffbcd7b222d8e7bb85a7d8e8325df7699
- affected 3242ba117e9bd29eb748afd6f6fbfbd6dd7cfe52 – < e9438ab5328a177c9c0e5df87eb92a7162841e98
- affected 3.17
- unaffected < 3.17
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.55 – ≤ 6.18.*
- unaffected 7.2.9 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/e380fba02908b809f5bbef371259003cf5887bb4 (opens in a new tab)
- https://git.kernel.org/stable/c/a3e9b7f7c9558f8c9592f8f817557bff98707bb3 (opens in a new tab)
- https://git.kernel.org/stable/c/60a76cdd92e25f576dc58d756a565760dde1f7a1 (opens in a new tab)
- https://git.kernel.org/stable/c/25c08be2a5e7715f19a6e02bbe9b0e5f01c77aac (opens in a new tab)
- https://git.kernel.org/stable/c/6e05f1c614a57a5d4c364dd12e20c6fd012f9d3e (opens in a new tab)
- https://git.kernel.org/stable/c/58a417a19d80141fff3abe6004e2e47285506e73 (opens in a new tab)
- https://git.kernel.org/stable/c/6e20dabffbcd7b222d8e7bb85a7d8e8325df7699 (opens in a new tab)
- https://git.kernel.org/stable/c/e9438ab5328a177c9c0e5df87eb92a7162841e98 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103572 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98527)Record last updated .