CVE-2026-99214: drm/vc4: hdmi: Move packet RAM enable to PM runtime
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: hdmi: Move packet RAM enable to PM runtime
Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe() for the audio infoframe. vc4hdmiwriteinfoframe() needs Packet RAM to be on to store the infoframe, however, if the video hasn't been enabled, vc4hdmiencoderpostcrtcenable() hasn't been called and therefore, the Packet RAM can be disabled by the time vc4hdmiwriteinfoframe() executes, causing the following splat:
[ 201.570266] ------------[ cut here ]------------ [ 201.570293] Packet RAM has to be on to store the packet. [ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4hdmi.c:683 at vc4hdmiwriteinfoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606 [...] [ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 201.758499] Call trace: [ 201.760967] vc4hdmiwriteinfoframe+0x404/0x494 [vc4] (P) [ 201.766607] vc4hdmiwriteaudioinfoframe+0x1c/0x28 [vc4] [ 201.772247] writeinfoframe+0xbc/0x140 [drmdisplayhelper] [ 201.777975] drmatomichelperconnectorhdmiupdateaudioinfoframe+0x80/0xdc [drmdisplayhelper] [ 201.787140] vc4hdmiaudioprepare+0x4ac/0x570 [vc4] [ 201.792252] drmconnectorhdmiaudioprepare+0x24/0x30 [drmdisplayhelper] [ 201.799390] hdmicodecprepare+0x100/0x160 [sndsochdmicodec] [ 201.805471] sndsocpcmdaiprepare+0xd4/0x100 [sndsoccore] [ 201.811375] socpcmprepare+0x60/0x12c [sndsoccore] [ 201.816752] socpcmprepare+0x34/0x58 [sndsoccore] [ 201.821863] sndpcmdoprepare+0x70/0x8c [sndpcm] [ 201.826798] sndpcmactionnonatomic+0xe4/0x174 [sndpcm] [ 201.832350] sndpcmprepare+0xc8/0xd8 [sndpcm] [ 201.837021] sndpcmcommonioctl+0x458/0x614 [sndpcm] [ 201.842308] sndpcmioctl+0x30/0x48 [sndpcm] [ 201.846802] arm64sysioctl+0x88/0xd8 [ 201.850769] invokesyscall+0x48/0xf4 [ 201.854470] el0svccommon+0x80/0xd8 [ 201.858171] doel0svc+0x1c/0x28 [ 201.861520] el0svc+0x3c/0xb0 [ 201.864605] el0t64synchandler+0x68/0xdc [ 201.868834] el0t64sync+0x198/0x19c [ 201.872536] ---[ end trace 0000000000000000 ]---
Considering that Packet RAM enable is essentially a power management configuration, move its enabling/disabling to the Runtime PM hooks.
Note that postcrtcdisable() still stops all infoframes, but keeps Packet RAM enabled, leaving it to be disabled by runtime suspend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Move Packet RAM enabling and disabling to the runtime power-management hooks so Packet RAM remains enabled when vc4_hdmi_write_infoframe() stores audio infoframes before video has been enabled.
Linux kernel vc4 HDMI driver Packet RAM enable/disable = Runtime PM hooks