In the Linux kernel, the Xilinx GPIO driver leaks a runtime power‑management reference when a request fails. The driver increments a usage counter with pm_runtime_get_sync() but never decrements it on failure, leaving the counter permanently increased and preventing the controller from suspending. The consequence is that the device’s clock remains enabled, which can lead to increased power consumption and potentially affect system stability. This vulnerability is a local denial‑of‑service that prevents proper low‑power state transitions.

Any system running a Linux kernel with the Xilinx GPIO driver compiled in is vulnerable, regardless of hardware. Because the vendor lists Linux:Linux as the affected product and no specific kernel version is supplied, all kernel builds containing the unpatched driver are at risk until the fix is applied.

The risk is local; an attacker who can repeatedly trigger a failed request to the driver could maintain the increased counter, keeping the device awake. The CVSS score of 2.5 indicates low severity, the EPSS score of < 1% shows very low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The vulnerability does not provide a remote or privileged escalation path, and the fix replaces pm_runtime_get_sync() with pm_runtime_resume_and_get() to increment the counter only on success, eliminating the leak.