UBUNTU-CVE-2026-99214: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe() for the audio infoframe. vc4hdmiwriteinfoframe() needs Packet RAM to be on to store the infoframe, however, if the video hasn't been enabled, vc4hdmiencoderpostcrtcenable() hasn't been called and therefore, the Packet RAM can be disabled by the time vc4hdmiwriteinfoframe() executes, causing the following splat: [ 201.570266] ------------[ cut here ]------------ [ 201.570293] Packet RAM has to be on to store the packet. [ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4hdmi.c:683 at vc4hdmiwriteinfoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606 [...] [ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 201.758499] Call trace: [ 201.760967] vc4hdmiwriteinfoframe+0x404/0x494 [vc4] (P) [ 201.766607] vc4hdmiwriteaudioinfoframe+0x1c/0x28 [vc4] [ 201.772247] writeinfoframe+0xbc/0x140 [drmdisplayhelper] [ 201.777975] drmatomichelperconnectorhdmiupdateaudioinfoframe+0x80/0xdc [drmdisplayhelper] [ 201.787140] vc4hdmiaudioprepare+0x4ac/0x570 [vc4] [ 201.792252] drmconnectorhdmiaudioprepare+0x24/0x30 [drmdisplayhelper] [ 201.799390] hdmicodecprepare+0x100/0x160 [sndsochdmicodec] [ 201.805471] sndsocpcmdaiprepare+0xd4/0x100 [sndsoccore] [ 201.811375] socpcmprepare+0x60/0x12c [sndsoccore] [ 201.816752] socpcmprepare+0x34/0x58 [sndsoccore] [ 201.821863] sndpcmdoprepare+0x70/0x8c [sndpcm] [ 201.826798] sndpcmactionnonatomic+0xe4/0x174 [sndpcm] [ 201.832350] sndpcmprepare+0xc8/0xd8 [sndpcm] [ 201.837021] sndpcmcommonioctl+0x458/0x614 [sndpcm] [ 201.842308] sndpcmioctl+0x30/0x48 [sndpcm] [ 201.846802] arm64sysioctl+0x88/0xd8 [ 201.850769] invokesyscall+0x48/0xf4 [ 201.854470] el0svccommon+0x80/0xd8 [ 201.858171] doel0svc+0x1c/0x28 [ 201.861520] el0svc+0x3c/0xb0 [ 201.864605] el0t64synchandler+0x68/0xdc [ 201.868834] el0t64sync+0x198/0x19c [ 201.872536] ---[ end trace 0000000000000000 ]--- Considering that Packet RAM enable is essentially a power management configuration, move its enabling/disabling to the Runtime PM hooks. Note that postcrtcdisable() still stops all infoframes, but keeps Packet RAM enabled, leaving it to be disabled by runtime suspend.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Move Packet RAM enabling and disabling to the Runtime PM hooks; keep Packet RAM enabled after post_crtc_disable() and disable it during runtime suspend.
Linux kernel drm/vc4 HDMI Packet RAM enable/disable = Manage in Runtime PM hooks
Event History
Frequently Asked Questions
What conditions are needed to trigger the warning?
Audio must be triggered by the HDMI hot-plug-detect handler before video has been restored. In that sequence, the audio infoframe write can occur while Packet RAM is disabled because the video enable path has not run.
How can I tell whether this issue has occurred on a system?
Kernel logs can show a warning stating "Packet RAM has to be on to store the packet" at vc4_hdmi_write_infoframe(), with a call trace through vc4_hdmi_write_audio_infoframe() and the DRM display helper audio-infoframe update path.