CVE-2026-99214

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: hdmi: Move packet RAM enable to PM runtime

Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4 hdmi write infoframe() for the audio infoframe. vc4 hdmi write infoframe() needs Packet RAM to be on to store the infoframe, however, if the video hasn't been enabled, vc4 hdmi encoder post crtc enable() hasn't been called and therefore, the Packet RAM can be disabled by the time vc4 hdmi write infoframe() executes, causing the following splat:

[ 201.570266] ------------[ cut here ]------------ [ 201.570293] Packet RAM has to be on to store the packet. [ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4 hdmi.c:683 at vc4 hdmi write infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606 [...] [ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 201.758499] Call trace: [ 201.760967] vc4 hdmi write infoframe+0x404/0x494 [vc4] (P) [ 201.766607] vc4 hdmi write audio infoframe+0x1c/0x28 [vc4] [ 201.772247] write infoframe+0xbc/0x140 [drm display helper] [ 201.777975] drm atomic helper connector hdmi update audio infoframe+0x80/0xdc [drm display helper] [ 201.787140] vc4 hdmi audio prepare+0x4ac/0x570 [vc4] [ 201.792252] drm connector hdmi audio prepare+0x24/0x30 [drm display helper] [ 201.799390] hdmi codec prepare+0x100/0x160 [snd soc hdmi codec] [ 201.805471] snd soc pcm dai prepare+0xd4/0x100 [snd soc core] [ 201.811375] soc pcm prepare+0x60/0x12c [snd soc core] [ 201.816752] soc pcm prepare+0x34/0x58 [snd soc core] [ 201.821863] snd pcm do prepare+0x70/0x8c [snd pcm] [ 201.826798] snd pcm action nonatomic+0xe4/0x174 [snd pcm] [ 201.832350] snd pcm prepare+0xc8/0xd8 [snd pcm] [ 201.837021] snd pcm common ioctl+0x458/0x614 [snd pcm] [ 201.842308] snd pcm ioctl+0x30/0x48 [snd pcm] [ 201.846802] arm64 sys ioctl+0x88/0xd8 [ 201.850769] invoke syscall+0x48/0xf4 [ 201.854470] el0 svc common+0x80/0xd8 [ 201.858171] do el0 svc+0x1c/0x28 [ 201.861520] el0 svc+0x3c/0xb0 [ 201.864605] el0t 64 sync handler+0x68/0xdc [ 201.868834] el0t 64 sync+0x198/0x19c [ 201.872536] ---[ end trace 0000000000000000 ]---

Considering that Packet RAM enable is essentially a power management configuration, move its enabling/disabling to the Runtime PM hooks.

Note that post crtc disable() still stops all infoframes, but keeps Packet RAM enabled, leaving it to be disabled by runtime suspend.