In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter     incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does     not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(),     never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays     enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.
    (CVE-2026-99049)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379497	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24651-1)	Nessus	SuSE Local Security Checks	Local	high
379474	SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24662-1)	Nessus	SuSE Local Security Checks	Local	high
375086	Photon OS 5.0: Linux PHSA-2026-5.0-92-1044	Nessus	PhotonOS Local Security Checks	Local	critical
371523	Linux Distros Unpatched Vulnerability : CVE-2026-99049	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-99049

low

Tenable Plugins

high

high

critical

medium