{"id":"CVE-2026-99214","kind":"vulnerability","aliases":["CVE-2026-99214"],"related":[],"title":"Linux kernel vc4 HDMI driver: audio can start before video, causing a warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn't been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[  201.570266] ------------[ cut here ]------------\n[  201.570293] Packet RAM has to be on to store the packet.\n[  201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606\n[...]\n[  201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[...]\n[  201.758499] Call trace:\n[  201.760967]  vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)\n[  201.766607]  vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]\n[  201.772247]  write_infoframe+0xbc/0x140 [drm_display_helper]\n[  201.777975]  drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]\n[  201.787140]  vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]\n[  201.792252]  drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]\n[  201.799390]  hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]\n[  201.805471]  snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]\n[  201.811375]  __soc_pcm_prepare+0x60/0x12c [snd_soc_core]\n[  201.816752]  soc_pcm_prepare+0x34/0x58 [snd_soc_core]\n[  201.821863]  snd_pcm_do_prepare+0x70/0x8c [snd_pcm]\n[  201.826798]  snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]\n[  201.832350]  snd_pcm_prepare+0xc8/0xd8 [snd_pcm]\n[  201.837021]  snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]\n[  201.842308]  snd_pcm_ioctl+0x30/0x48 [snd_pcm]\n[  201.846802]  __arm64_sys_ioctl+0x88/0xd8\n[  201.850769]  invoke_syscall+0x48/0xf4\n[  201.854470]  el0_svc_common+0x80/0xd8\n[  201.858171]  do_el0_svc+0x1c/0x28\n[  201.861520]  el0_svc+0x3c/0xb0\n[  201.864605]  el0t_64_sync_handler+0x68/0xdc\n[  201.868834]  el0t_64_sync+0x198/0x19c\n[  201.872536] ---[ end trace 0000000000000000 ]---\n\nConsidering that Packet RAM enable is essentially a power management\nconfiguration, move its enabling/disabling to the Runtime PM hooks.\n\nNote that post_crtc_disable() still stops all infoframes, but keeps Packet\nRAM enabled, leaving it to be disabled by runtime suspend.","summary":"In the Linux kernel's vc4 HDMI driver, audio can start from the hotplug handler before video is restored, so the audio infoframe is written while Packet RAM is powered off. The fix moves Packet RAM power control into the runtime PM hooks so the RAM stays on while infoframes are written.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hdmi-audio","linux-kernel","raspberry-pi","runtime"],"not_affected_if":["no-vc4-driver"],"how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel in the NVD record\n- Check whether the vc4 DRM driver is loaded with `lsmod | grep vc4` (Raspberry Pi 4 class boards use it for HDMI)","fix":"- Update the Linux kernel to a release that includes the upstream commit moving Packet RAM enable to PM runtime (version unknown from the sources; check the NVD record or the kernel stable tree)","status":"open","published_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:38+00:00","triaged_at":"2026-10-28T11:33:47+00:00","updated_at":"2026-10-28T11:33:47+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:33:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit moving Packet RAM enable to PM runtime (version unknown from the sources; check the NVD record or the kernel stable tree)","reach":"local","title":"Linux kernel vc4 HDMI driver: audio can start before video, causing a warning","impact":"low","summary":"In the Linux kernel's vc4 HDMI driver, audio can start from the hotplug handler before video is restored, so the audio infoframe is written while Packet RAM is powered off. The fix moves Packet RAM power control into the runtime PM hooks so the RAM stays on while infoframes are written.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","raspberry-pi","hdmi-audio"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources describe a kernel warning, not a demonstrated exploit","analyst_note":"Check the NVD record and the upstream kernel commit for the fixed kernel version and whether the flaw is more than a warning.","how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel in the NVD record\n- Check whether the vc4 DRM driver is loaded with `lsmod | grep vc4` (Raspberry Pi 4 class boards use it for HDMI)","needs_analyst":true,"not_affected_if":["no-vc4-driver"],"who_is_affected":"Only systems running a Linux kernel with the vc4 DRM driver and HDMI audio, such as Raspberry Pi 4 boards, are affected. The sources describe a kernel warning and a driver ordering bug; they do not describe a clear path to code execution or data exposure. Systems without vc4 can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00078,"input_tokens":4562,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':201C,226C,236C,242C,256C,266C,275C,284C,296C,305C,314C,324C,333C,341C,350C,358C,366C,371C,377C,383C,388C,395C,401C '-2026':15A,18A '-99214':16A,19A '0':205C '0000000000000000':406C '1.5':216C '201.570266':178C '201.570293':181C '201.570367':192C '201.658650':207C '201.758499':218C '201.760967':221C '201.766607':230C '201.772247':239C '201.777975':247C '201.787140':261C '201.792252':269C '201.799390':280C '201.805471':290C '201.811375':301C '201.816752':310C '201.821863':319C '201.826798':328C '201.832350':337C '201.837021':345C '201.842308':354C '201.846802':362C '201.850769':368C '201.854470':373C '201.858171':379C '201.861520':385C '201.864605':390C '201.868834':397C '201.872536':403C '4':212C '64':392C,399C '683':195C 'action':331C 'arm64':363C 'atom':249C 'audio':6A,22B,38B,51B,101C,124C,234C,254C,264C,273C 'b':214C 'call':117C,157C,219C 'caus':11A,174C 'codec':282C,289C 'common':348C,376C 'configur':417C 'connector':251C,271C 'consid':407C 'control':67B 'core':300C,309C,318C 'cpu':204C 'crtc':152C,429C 'cut':179C 'cve':14A,17A 'dai':294C 'disabl':165C,430C,444C 'display':245C,259C,278C 'driver':5A,37B 'drivers/gpu/drm/vc4/vc4_hdmi.c':194C 'drm':244C,248C,258C,270C,277C 'drm/vc4':92C 'dt':217C 'el0':374C,381C,386C 'el0t':391C,398C 'enabl':97C,147C,153C,411C,439C 'enabling/disabling':420C 'encod':150C 'end':404C 'essenti':413C 'execut':173C 'fix':62B 'follow':87C,176C 'handler':44B,108C,394C 'hardwar':208C 'hasn':144C,154C 'hdmi':4A,21B,36B,93C,119C,127C,149C,170C,198C,223C,232C,252C,263C,272C,281C,288C 'hdmi-audio':20B 'helper':246C,250C,260C,279C 'hook':72B,425C 'hotplug':43B 'howev':140C 'hpd':107C 'infofram':52B,79B,121C,125C,129C,139C,172C,200C,225C,235C,241C,255C,434C 'invok':369C 'ioctl':349C,357C,365C 'keep':436C 'kernel':2A,25B,33B,85C 'leav':440C 'linux':1A,24B,32B,84C 'linux-kernel':23B 'manag':416C 'model':213C 'move':63B,94C,418C 'name':209C 'need':130C 'nonatom':332C 'note':426C 'p':229C 'packet':56B,64B,95C,131C,161C,182C,191C,409C,437C 'pcm':293C,303C,312C,321C,327C,330C,336C,339C,344C,347C,353C,356C,361C 'pi':28B,211C 'pm':71B,99C,424C 'post':151C,428C 'power':59B,66B,415C 'prepar':265C,274C,283C,295C,304C,313C,323C,340C 'ram':57B,65B,75B,96C,132C,162C,183C,410C,438C 'raspberri':27B,210C 'raspberry-pi':26B 'resolv':91C 'restor':48B,116C 'rev':215C 'runtim':29B,70B,100C,423C,446C 'snd':286C,291C,298C,307C,316C,320C,326C,329C,335C,338C,343C,346C,352C,355C,360C 'soc':287C,292C,299C,302C,308C,311C,317C 'splat':177C 'start':8A,40B,110C 'stay':76B 'still':431C 'stop':432C 'store':137C,189C 'suspend':447C 'svc':375C,382C,387C 'sync':393C,400C 'sys':364C 'syscal':370C 'therefor':159C 'time':168C 'trace':220C,405C 'trigger':104C 'updat':253C 'vc4':3A,35B,118C,126C,148C,169C,197C,203C,222C,228C,231C,238C,262C,268C 'video':10A,46B,113C,143C 'vulner':88C 'warn':13A,193C 'wireplumber/1606':206C 'write':120C,128C,171C,199C,224C,233C,240C 'written':54B,81B 'x100/0x160':285C 'x198/0x19c':402C 'x1c/0x28':237C,384C 'x24/0x30':276C 'x30/0x48':359C 'x34/0x58':315C 'x3c/0xb0':389C 'x404/0x494':202C,227C 'x458/0x614':351C 'x48/0xf4':372C 'x4ac/0x570':267C 'x60/0x12c':306C 'x68/0xdc':396C 'x70/0x8c':325C 'x80/0xd8':378C 'x80/0xdc':257C 'x88/0xd8':367C 'xbc/0x140':243C 'xc8/0xd8':342C 'xd4/0x100':297C 'xe4/0x174':334C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the vc4 DRM driver and HDMI audio, such as Raspberry Pi 4 boards, are affected. The sources describe a kernel warning and a driver ordering bug; they do not describe a clear path to code execution or data exposure. Systems without vc4 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99214","severity":null,"published_at":"2026-10-28T11:17:42+00:00","modified_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:38+00:00","fetched_at":"2026-10-28T11:32:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}