The kernel’s Zynq GPIO driver has a bug where pm_runtime_get_sync() increments a usage counter even when it fails, and zynq_gpio_request() propagates the error without decrementing this count. This means the normally released reference to the GPIO controller remains held, preventing the controller from being runtime‑suspended. Consequently the controller’s clock stays enabled and the device continues to consume power even though the GPIO access has failed. Based on the description, it is inferred that the leak is only triggered on error paths during GPIO request handling.

All Linux kernel implementations that ship the unpatched Zynq GPIO driver are affected. The vulnerability resides in the Linux kernel’s Zynq GPIO driver; it applies to any kernel build that includes this driver without the patch. No specific sub‑versions are listed, so any kernel version prior to the commit that introduced pm_runtime_resume_and_get() is vulnerable.

The CVSS score of 2.5 reflects a low severity, and the EPSS score of less than 1% indicates a small likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an internal failure of the driver’s runtime‑PM call; an attacker would need to induce a failed GPIO request, which is unlikely in normal use. Based on the description, it is inferred that the attacker would need to trigger a failed GPIO request to realize the leak. Despite the low environmental score, the persistent power‑management leak can accumulate to significant energy loss in battery‑powered deployments. The overall risk is considered low to medium, consisting mainly of increased power consumption rather than direct code execution or denial of service.