{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24153", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2026-01-21T19:09:29.850Z", "datePublished": "2026-03-31T16:23:14.585Z", "dateUpdated": "2026-04-01T13:59:00.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:23:14.585Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-501", "description": "CWE-501 Trust Boundary Violation", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Information disclosure"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(35)"], "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(36)"], "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(38)"], "versions": [{"status": "affected", "version": "38.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.", "supportingMedia": [{"type": "text/html", "base64": true, "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24153"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24153"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:58:53.370137Z", "id": "CVE-2026-24153", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:59:00.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24153", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:58:53.370137Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:58:56.958Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Information disclosure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "platforms": ["Jetson Linux(35)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "platforms": ["Jetson Linux(36)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "38.2"}], "platforms": ["Jetson Linux(38)"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24153"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24153"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-501", "description": "CWE-501 Trust Boundary Violation"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:23:14.585Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24153", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:59:00.585Z", "dateReserved": "2026-01-21T19:09:29.850Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2026-03-31T16:23:14.585Z", "assignerShortName": "nvidia"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure."}], "id": "CVE-2026-24153", "lastModified": "2026-04-01T14:24:02.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 4.0, "source": "psirt@nvidia.com", "type": "Secondary"}]}, "published": "2026-03-31T17:16:30.080", "references": [{"source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24153"}, {"source": "psirt@nvidia.com", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}, {"source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24153"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-501"}], "source": "psirt@nvidia.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["Jetson Linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}], "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}], "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(35)"], "status": "affected", "versions": {"scheme": "smever", "value": "[0,35.6.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "jetson_xavier_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "product": "jetson_xavier_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "product": "jetson_xavier_series", "vendor": "nvidia"}], "analysis": {"en": {"generated_at": "2026-03-31T17:51:03.182799+00:00", "value": {"mitigation_remediation": ["Disable the nvluks trusted application in the initrd configuration.", "Apply any vendor-released firmware, OS, or JetPack updates that correct the initrd configuration.", "Verify the integrity and configuration of the initrd to confirm the trusted application is disabled.", "Monitor device logs for any attempts to read or manipulate the nvluks sensitive data.", "Contact NVIDIA support for further guidance if the issue persists."], "summary": {"action": "Assess Impact", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects NVIDIA Jetson devices built on the Xavier Series, Orin Series, and Thor models. No specific firmware or OS versions are listed, so any device that includes the affected initrd and leaves the nvluks trusted application enabled is potentially susceptible.", "description_and_impact": "A flaw in NVIDIA Jetson Linux initrd keeps the nvluks trusted application enabled by default. This misconfiguration allows an attacker to view data that is meant to be protected, resulting in potential leakage of sensitive information. The weakness is classified as CWE\u2011501, insecure default configuration leading to information exposure.", "risk_and_exploitability": "The CVSS score of 5.2 indicates moderate severity. EPSS data is not provided, so the likelihood of exploitation cannot be quantified. The likely attack vector requires an adversary with physical access or the ability to modify firmware to manipulate the initrd environment. The issue is not included in the CISA Known Exploited Vulnerabilities catalog, suggesting no known public exploitation. Nevertheless, the disclosure of protected data is a significant risk and should be mitigated promptly."}}}}, "created": "2026-03-31T19:53:58.738993+00:00", "title": "Information Disclosure via Undisabled nvluks Trusted Application in NVIDIA Jetson Linux Initrd", "updated": "2026-03-31T20:37:56.310207+00:00", "vendors": ["nvidia", "nvidia$PRODUCT$jetson_orin_series", "nvidia$PRODUCT$jetson_thor", "nvidia$PRODUCT$jetson_xavier_series"]}