CVE-2026-98527 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel deployments, especially those using the Zynq GPIO driver, should assess exposure and prioritize verification of affected versions and remediation.

Why it matters

CVE-2026-98527 is a Linux kernel vulnerability that could potentially lead to a runtime power management (PM) leak on the error path of the GPIO request. Defenders responsible for Linux kernel deployments, especially those using the Zynq GPIO driver, should assess exposure and prioritize verification of affected versions and remediation.

• Verification of affected Linux kernel versions and deployments is required to determine exposure.
• Remediation priority is high for deployments using the Zynq GPIO driver.
• Power management (PM) leak could lead to increased power consumption and potential system instability.

Technical summary

The Linux kernel vulnerability (CVE-2026-98527) is related to the Zynq GPIO driver's handling of runtime power management (PM) on the error path of the GPIO request. The issue arises from pm_runtime_get_sync() incrementing the usage counter even when it fails, and the error path in zynq_gpio_request() not dropping it, resulting in a leaked reference. This vulnerability could potentially lead to a runtime power management (PM) leak on the error path of the GPIO request. Defenders responsible for Linux kernel deployments, especially those using the Zynq GPIO driver, should assess exposure and prioritize verification of affected versions and remediation.

Defensive priority

Defenders should assess exposure and prioritize verification of affected Linux kernel versions and deployments, especially those using the Zynq GPIO driver.

Recommended defensive actions

• Assess exposure by checking Linux kernel versions and deployments using the Zynq GPIO driver.
• Verify if the system is affected by checking the official Linux kernel sources and NVD entry.
• Consider applying patches or updates provided by the Linux kernel maintainers.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish specific affected versions, exploitation, or remediation details, which require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.