CVE-2026-98529 Linux CVE debrief

Who should care

Linux kernel maintainers and users who need to assess exposure and verify runtime PM reference handling in arizona_gpio_direction_out(). This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the runtime PM leak in the Linux kernel.

Why it matters

Linux kernel maintainers and users should assess exposure and verify runtime PM reference handling in arizona_gpio_direction_out().

• Verify runtime PM reference handling in arizona_gpio_direction_out().
• Assess exposure to potential runtime PM leaks in the Linux kernel.

Technical summary

The Linux kernel vulnerability allows a runtime PM leak in arizona_gpio_direction_out(). This occurs because switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device. If the subsequent regmap_update_bits() fails, the reference is never dropped, and no later direction_in() can balance it since the direction was never changed. Linux kernel maintainers and users should assess exposure and verify runtime PM reference handling in arizona_gpio_direction_out(). The vulnerability has a CVSS score and severity that are currently null, indicating a need for further assessment.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify runtime PM reference handling in arizona_gpio_direction_out().

Recommended defensive actions

• Review and apply the provided patch to fix the runtime PM leak in arizona_gpio_direction_out().
• Verify that the Linux kernel version in use is not affected by this vulnerability.
• Monitor for any potential issues related to runtime PM reference handling in the Linux kernel.
• Assess exposure to potential runtime PM leaks in the Linux kernel.
• Verify runtime PM reference handling in arizona_gpio_direction_out().
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Linux kernel vulnerability allows a runtime PM leak in arizona_gpio_direction_out(). This is based on the supplied source corpus, which notes that switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device. However, if the subsequent regmap_update_bits() fails, the reference is never dropped. The evidence is limited to the information provided in the source corpus, and defenders should verify the handling of runtime PM references in arizona_gpio_direction_out() to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.