CVE-2026-24153

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24153", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2026-01-21T19:09:29.850Z", "datePublished": "2026-03-31T16:23:14.585Z", "dateUpdated": "2026-04-01T13:59:00.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:23:14.585Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-501", "description": "CWE-501 Trust Boundary Violation", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Information disclosure"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(35)"], "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(36)"], "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(38)"], "versions": [{"status": "affected", "version": "38.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.", "supportingMedia": [{"type": "text/html", "base64": true, "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24153"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24153"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:58:53.370137Z", "id": "CVE-2026-24153", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:59:00.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24153", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:58:53.370137Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:58:56.958Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Information disclosure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "platforms": ["Jetson Linux(35)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "platforms": ["Jetson Linux(36)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "38.2"}], "platforms": ["Jetson Linux(38)"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24153"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24153"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-501", "description": "CWE-501 Trust Boundary Violation"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:23:14.585Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24153", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:59:00.585Z", "dateReserved": "2026-01-21T19:09:29.850Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2026-03-31T16:23:14.585Z", "assignerShortName": "nvidia"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Jetson Linux(35)"], "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}]}, {"defaultStatus": "unaffected", "platforms": ["Jetson Linux(36)"], "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 36.5"}]}, {"defaultStatus": "unaffected", "platforms": ["Jetson Linux(38)"], "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "38.2"}]}], "source": "psirt@nvidia.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*", "matchCriteriaId": "B73BF007-6D88-4803-B94B-647CCEC5E291", "versionEndExcluding": "35.6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*", "matchCriteriaId": "23FF116C-64BD-4F4D-960F-92A289CB8150", "versionEndExcluding": "36.5", "versionStartIncluding": "36.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:nvidia:jetson_linux:38.2:*:*:*:*:*:*:*", "matchCriteriaId": "1FAEFF9B-826E-43AA-A67E-AB89871ED945", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_32gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "D196FDF9-FC0F-4411-826D-5A7416F26159", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_64gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "2392844C-6B11-41EA-A280-3AF1BDB77DC2", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A7F9D64-EA34-4309-8B2B-293346BD6D25", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_industrial:-:*:*:*:*:*:*:*", "matchCriteriaId": "211E860F-BEFF-4407-967B-3C1332268D8E", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_thor_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "CFEAFC57-D875-43A7-806F-6F4F07F473C8", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "4F92D471-8E65-41FC-A5DE-255136F6F989", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_64gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "B51F666B-F3ED-4CF3-B48E-B39BDE1C2579", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_industrial:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C7C6B22-EBD3-4465-9852-4A4844AA714A", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_4gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "80DA8F1E-9ED6-476A-9C9F-3DC231E5142D", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD549248-1C2C-4A0C-9822-691F3D77AEB1", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_super_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F4ECB54-9725-4BFA-A9E7-2F24EAE5BDAB", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_16gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D96D5C9-4F9F-4487-90B9-0D8D473D4C6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3CF8EB6-767C-43F8-A327-A2D4A91A7CF1", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_t4000:-:*:*:*:*:*:*:*", "matchCriteriaId": "6DDF9FD4-4FE1-4523-BDD6-BEF82B4FFD73", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_t5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "ADCF7D93-C341-4ED4-86CC-2BB7FF31F620", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_16gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "A36028A3-EE83-4158-9039-5C6C795FA048", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "22852BE0-B587-48B4-A7B6-6496715C32EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure."}, {"lang": "es", "value": "NVIDIA Jetson Linux tiene una vulnerabilidad en initrd, donde la aplicaci\u00f3n de confianza nvluks no est\u00e1 deshabilitada. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a la revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-24153", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 4.0, "source": "psirt@nvidia.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24153", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:58:53.370137Z", "version": "2.0.3"}}]}, "published": "2026-03-31T17:16:30.080", "references": [{"source": "psirt@nvidia.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24153"}, {"source": "psirt@nvidia.com", "tags": ["Vendor Advisory"], "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}, {"source": "psirt@nvidia.com", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-24153"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-501"}], "source": "psirt@nvidia.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["Jetson Linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}], "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}], "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(35)"], "status": "affected", "versions": {"scheme": "smever", "value": "[0,35.6.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "jetson_xavier_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "product": "jetson_xavier_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["Jetson Linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "product": "jetson_xavier_series", "vendor": "nvidia"}], "analysis": {"en": {"generated_at": "2026-04-03T22:30:40.743471+00:00", "value": {"mitigation_remediation": ["Apply the latest NVIDIA Jetson Linux firmware update that disables the nvluks trusted application in the initrd.", "Verify that the initrd no longer contains the enabled nvluks component after the update.", "If an update is unavailable, consider disabling the nvluks trusted application manually, if the platform allows, to prevent information leakage.", "Monitor NVIDIA\u2019s security advisories for any future patches or additional guidance."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected hardware includes the NVIDIA Jetson Xavier Series, Jetson Orin Series, and Jetson Thor family, all running Jetson Linux 38.2 and later. The vulnerability is present in the initrd image bundled with these devices, regardless of specific model or storage capacity. Any Jetson device that has not applied the latest firmware update is potentially vulnerable.", "description_and_impact": "Information disclosure can occur on NVIDIA Jetson Linux platforms when the initrd contains an enabled nvluks trusted application that should be disabled. The vulnerable component allows the extraction of sensitive data stored on the device, as the trust boundary is not properly enforced. This weakness corresponds to CWE\u2011501, where flaws in handling cryptographic material lead to leakage of confidential information.", "risk_and_exploitability": "The CVSS score of 5.2 places this issue in the medium impact range. EPSS indicates a probability of exploitation below 1\u202f%, and the vulnerability is not listed in CISA\u2019s KEV catalog. Because the flaw resides in the boot/initrd stage, an attacker would need local or physical access to the device to tamper with or observe the initrd contents. Consequently, while the exploitation likelihood is low, the potential for confidential data exposure warrants prompt remediation."}}}}, "created": "2026-03-31T19:53:58.738993+00:00", "updated": "2026-04-07T08:07:56.755820+00:00", "vendors": ["nvidia", "nvidia$PRODUCT$jetson_orin_series", "nvidia$PRODUCT$jetson_thor", "nvidia$PRODUCT$jetson_xavier_series"]}