CVE-2026-99214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99214", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.401Z", "datePublished": "2026-10-28T10:36:07.867Z", "dateUpdated": "2026-10-30T12:43:00.909Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:43:00.909Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn't been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[ 201.570266] ------------[ cut here ]------------\n[ 201.570293] Packet RAM has to be on to store the packet.\n[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606\n[...]\n[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[...]\n[ 201.758499] Call trace:\n[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)\n[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]\n[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]\n[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]\n[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]\n[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]\n[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]\n[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]\n[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]\n[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]\n[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]\n[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]\n[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]\n[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]\n[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]\n[ 201.846802] __arm64_sys_ioctl+0x88/0xd8\n[ 201.850769] invoke_syscall+0x48/0xf4\n[ 201.854470] el0_svc_common+0x80/0xd8\n[ 201.858171] do_el0_svc+0x1c/0x28\n[ 201.861520] el0_svc+0x3c/0xb0\n[ 201.864605] el0t_64_sync_handler+0x68/0xdc\n[ 201.868834] el0t_64_sync+0x198/0x19c\n[ 201.872536] ---[ end trace 0000000000000000 ]---\n\nConsidering that Packet RAM enable is essentially a power management\nconfiguration, move its enabling/disabling to the Runtime PM hooks.\n\nNote that post_crtc_disable() still stops all infoframes, but keeps Packet\nRAM enabled, leaving it to be disabled by runtime suspend."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_hdmi.c"], "versions": [{"version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "lessThan": "03cf08ed84fd43cd7d90696736dcde15f5eefca6", "status": "affected", "versionType": "git"}, {"version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "lessThan": "6b03e354526f6bad60ed3a7f08fec8b7d29d2f27", "status": "affected", "versionType": "git"}, {"version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "lessThan": "6a987992c78e2e04f71e685d1c589f8ea2151fa2", "status": "affected", "versionType": "git"}, {"version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "lessThan": "3f57b34485dc01e5a2db60a89a6ae5439a897e53", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_hdmi.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/03cf08ed84fd43cd7d90696736dcde15f5eefca6"}, {"url": "https://git.kernel.org/stable/c/6b03e354526f6bad60ed3a7f08fec8b7d29d2f27"}, {"url": "https://git.kernel.org/stable/c/6a987992c78e2e04f71e685d1c589f8ea2151fa2"}, {"url": "https://git.kernel.org/stable/c/3f57b34485dc01e5a2db60a89a6ae5439a897e53"}], "title": "drm/vc4: hdmi: Move packet RAM enable to PM runtime", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_hdmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "03cf08ed84fd43cd7d90696736dcde15f5eefca6", "status": "affected", "version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "versionType": "git"}, {"lessThan": "6b03e354526f6bad60ed3a7f08fec8b7d29d2f27", "status": "affected", "version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "versionType": "git"}, {"lessThan": "6a987992c78e2e04f71e685d1c589f8ea2151fa2", "status": "affected", "version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "versionType": "git"}, {"lessThan": "3f57b34485dc01e5a2db60a89a6ae5439a897e53", "status": "affected", "version": "b47a72f30768ffe76e105b3e91ad7022003e8504", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_hdmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn't been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[ 201.570266] ------------[ cut here ]------------\n[ 201.570293] Packet RAM has to be on to store the packet.\n[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606\n[...]\n[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[...]\n[ 201.758499] Call trace:\n[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)\n[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]\n[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]\n[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]\n[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]\n[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]\n[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]\n[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]\n[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]\n[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]\n[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]\n[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]\n[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]\n[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]\n[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]\n[ 201.846802] __arm64_sys_ioctl+0x88/0xd8\n[ 201.850769] invoke_syscall+0x48/0xf4\n[ 201.854470] el0_svc_common+0x80/0xd8\n[ 201.858171] do_el0_svc+0x1c/0x28\n[ 201.861520] el0_svc+0x3c/0xb0\n[ 201.864605] el0t_64_sync_handler+0x68/0xdc\n[ 201.868834] el0t_64_sync+0x198/0x19c\n[ 201.872536] ---[ end trace 0000000000000000 ]---\n\nConsidering that Packet RAM enable is essentially a power management\nconfiguration, move its enabling/disabling to the Runtime PM hooks.\n\nNote that post_crtc_disable() still stops all infoframes, but keeps Packet\nRAM enabled, leaving it to be disabled by runtime suspend."}], "id": "CVE-2026-99214", "lastModified": "2026-10-30T13:21:53.587", "metrics": {}, "published": "2026-10-28T11:17:42.887", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03cf08ed84fd43cd7d90696736dcde15f5eefca6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f57b34485dc01e5a2db60a89a6ae5439a897e53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a987992c78e2e04f71e685d1c589f8ea2151fa2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b03e354526f6bad60ed3a7f08fec8b7d29d2f27"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/vc4: hdmi: Move packet RAM enable to PM runtime", "id": "2562682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562682"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn't been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n[ 201.570266] ------------[ cut here ]------------\n[ 201.570293] Packet RAM has to be on to store the packet.\n[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606\n[...]\n[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[...]\n[ 201.758499] Call trace:\n[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)\n[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]\n[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]\n[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]\n[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]\n[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]\n[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]\n[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]\n[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]\n[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]\n[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]\n[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]\n[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]\n[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]\n[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]\n[ 201.846802] __arm64_sys_ioctl+0x88/0xd8\n[ 201.850769] invoke_syscall+0x48/0xf4\n[ 201.854470] el0_svc_common+0x80/0xd8\n[ 201.858171] do_el0_svc+0x1c/0x28\n[ 201.861520] el0_svc+0x3c/0xb0\n[ 201.864605] el0t_64_sync_handler+0x68/0xdc\n[ 201.868834] el0t_64_sync+0x198/0x19c\n[ 201.872536] ---[ end trace 0000000000000000 ]---\nConsidering that Packet RAM enable is essentially a power management\nconfiguration, move its enabling/disabling to the Runtime PM hooks.\nNote that post_crtc_disable() still stops all infoframes, but keeps Packet\nRAM enabled, leaving it to be disabled by runtime suspend.", "A flaw was found in the Linux kernel's VideoCore IV (VC4) HDMI driver. When audio playback initializes before video output is restored, the driver attempts to write audio configuration data to packet memory while it is still powered off. A local user initiating audio operations during display connection changes can trigger this condition, resulting in kernel errors and a potential Denial of Service (DoS)."], "name": "CVE-2026-99214", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99214\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99214\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99214.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b47a72f30768ffe76e105b3e91ad7022003e8504,6b03e354526f6bad60ed3a7f08fec8b7d29d2f27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b47a72f30768ffe76e105b3e91ad7022003e8504,6a987992c78e2e04f71e685d1c589f8ea2151fa2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b47a72f30768ffe76e105b3e91ad7022003e8504,3f57b34485dc01e5a2db60a89a6ae5439a897e53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b47a72f30768ffe76e105b3e91ad7022003e8504,6b03e354526f6bad60ed3a7f08fec8b7d29d2f27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b47a72f30768ffe76e105b3e91ad7022003e8504,6a987992c78e2e04f71e685d1c589f8ea2151fa2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b47a72f30768ffe76e105b3e91ad7022003e8504,3f57b34485dc01e5a2db60a89a6ae5439a897e53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.178997+00:00", "title": "Kernel Audio Infoframe Crash on Raspberry Pi HDMI", "updated": "2026-10-29T18:30:14.425982+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-617"]}