--- id: "CVE-2026-99214" kind: "vulnerability" aliases: ["CVE-2026-99214"] title: "Linux kernel vc4 HDMI driver: audio can start before video, causing a warning" severity: "unknown" cvss: null epss: null exploited: false status: "open" category: "runtime" products: [] ecosystems: [] tags: ["hdmi-audio", "linux-kernel", "raspberry-pi", "runtime"] not_affected_if: ["no-vc4-driver"] published_at: "2026-10-28T11:17:42+00:00" first_seen_at: "2026-10-28T11:32:38+00:00" updated_at: "2026-10-28T11:33:47+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99214", "first_seen_at": "2026-10-28T11:32:38+00:00"}] --- # Linux kernel vc4 HDMI driver: audio can start before video, causing a warning In the Linux kernel's vc4 HDMI driver, audio can start from the hotplug handler before video is restored, so the audio infoframe is written while Packet RAM is powered off. The fix moves Packet RAM power control into the runtime PM hooks so the RAM stays on while infoframes are written. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - `uname -r` to see the running kernel version, then compare it against the fixed kernel in the NVD record - Check whether the vc4 DRM driver is loaded with `lsmod | grep vc4` (Raspberry Pi 4 class boards use it for HDMI) ## Fix - Update the Linux kernel to a release that includes the upstream commit moving Packet RAM enable to PM runtime (version unknown from the sources; check the NVD record or the kernel stable tree) ## Timeline - 2026-10-28T11:32:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99214 ## From the sources In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4_hdmi_write_infoframe() for the audio infoframe. vc4_hdmi_write_infoframe() needs Packet RAM to be on to store the infoframe, however, if the video hasn't been enabled, vc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the Packet RAM can be disabled by the time vc4_hdmi_write_infoframe() executes, causing the following splat: [ 201.570266] ------------[ cut here ]------------ [ 201.570293] Packet RAM has to be on to store the packet. [ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606 [...] [ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 201.758499] Call trace: [ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P) [ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4] [ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper] [ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper] [ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4] [ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper] [ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec] [ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core] [ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core] [ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core] [ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm] [ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm] [ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm] [ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm] [ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm] [ 201.846802] __arm64_sys_ioctl+0x88/0xd8 [ 201.850769] invoke_syscall+0x48/0xf4 [ 201.854470] el0_svc_common+0x80/0xd8 [ 201.858171] do_el0_svc+0x1c/0x28 [ 201.861520] el0_svc+0x3c/0xb0 [ 201.864605] el0t_64_sync_handler+0x68/0xdc [ 201.868834] el0t_64_sync+0x198/0x19c [ 201.872536] ---[ end trace 0000000000000000 ]--- Considering that Packet RAM enable is essentially a power management configuration, move its enabling/disabling to the Runtime PM hooks. Note that post_crtc_disable() still stops all infoframes, but keeps Packet RAM enabled, leaving it to be disabled by runtime suspend. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_