CVE-2026-24154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24154", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2026-01-21T19:09:29.850Z", "datePublished": "2026-03-31T16:23:34.752Z", "dateUpdated": "2026-03-31T17:46:32.434Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:23:34.752Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Code execution, escalation of privileges, denial of service, data tampering, information disclosure"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(35)"], "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(36)"], "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "platforms": ["Jetson Linux(38)"], "versions": [{"status": "affected", "version": "38.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.", "supportingMedia": [{"type": "text/html", "base64": true, "value": "NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24154"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24154"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.6, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T17:46:16.608804Z", "id": "CVE-2026-24154", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T17:46:32.434Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T17:46:16.608804Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T17:46:27.806Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Code execution, escalation of privileges, denial of service, data tampering, information disclosure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "platforms": ["Jetson Linux(35)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "platforms": ["Jetson Linux(36)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "versions": [{"status": "affected", "version": "38.2"}], "platforms": ["Jetson Linux(38)"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24154"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24154"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:23:34.752Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24154", "state": "PUBLISHED", "dateUpdated": "2026-03-31T17:46:32.434Z", "dateReserved": "2026-01-21T19:09:29.850Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2026-03-31T16:23:34.752Z", "assignerShortName": "nvidia"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Jetson Linux(35)"], "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}]}, {"defaultStatus": "unaffected", "platforms": ["Jetson Linux(36)"], "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 36.5"}]}, {"defaultStatus": "unaffected", "platforms": ["Jetson Linux(38)"], "product": "Jetson Xavier Series, Jetson Orin Series and Jetson Thor", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "38.2"}]}], "source": "psirt@nvidia.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*", "matchCriteriaId": "B73BF007-6D88-4803-B94B-647CCEC5E291", "versionEndExcluding": "35.6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*", "matchCriteriaId": "23FF116C-64BD-4F4D-960F-92A289CB8150", "versionEndExcluding": "36.5", "versionStartIncluding": "36.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:nvidia:jetson_linux:38.2:*:*:*:*:*:*:*", "matchCriteriaId": "1FAEFF9B-826E-43AA-A67E-AB89871ED945", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_32gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "D196FDF9-FC0F-4411-826D-5A7416F26159", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_64gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "2392844C-6B11-41EA-A280-3AF1BDB77DC2", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A7F9D64-EA34-4309-8B2B-293346BD6D25", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_industrial:-:*:*:*:*:*:*:*", "matchCriteriaId": "211E860F-BEFF-4407-967B-3C1332268D8E", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_thor_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "CFEAFC57-D875-43A7-806F-6F4F07F473C8", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "4F92D471-8E65-41FC-A5DE-255136F6F989", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_64gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "B51F666B-F3ED-4CF3-B48E-B39BDE1C2579", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_industrial:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C7C6B22-EBD3-4465-9852-4A4844AA714A", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_4gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "80DA8F1E-9ED6-476A-9C9F-3DC231E5142D", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD549248-1C2C-4A0C-9822-691F3D77AEB1", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_super_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F4ECB54-9725-4BFA-A9E7-2F24EAE5BDAB", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_16gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D96D5C9-4F9F-4487-90B9-0D8D473D4C6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3CF8EB6-767C-43F8-A327-A2D4A91A7CF1", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_t4000:-:*:*:*:*:*:*:*", "matchCriteriaId": "6DDF9FD4-4FE1-4523-BDD6-BEF82B4FFD73", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_t5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "ADCF7D93-C341-4ED4-86CC-2BB7FF31F620", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_16gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "A36028A3-EE83-4158-9039-5C6C795FA048", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "22852BE0-B587-48B4-A7B6-6496715C32EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure."}, {"lang": "es", "value": "NVIDIA Jetson Linux tiene una vulnerabilidad en initrd, donde un atacante no privilegiado con acceso f\u00edsico podr\u00eda inyectar argumentos de l\u00ednea de comandos incorrectos. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, denegaci\u00f3n de servicio, manipulaci\u00f3n de datos y revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-24154", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 6.0, "source": "psirt@nvidia.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24154", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T17:46:16.608804Z", "version": "2.0.3"}}]}, "published": "2026-03-31T17:16:30.680", "references": [{"source": "psirt@nvidia.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24154"}, {"source": "psirt@nvidia.com", "tags": ["Vendor Advisory"], "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}, {"source": "psirt@nvidia.com", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-24154"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@nvidia.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["jetson_linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}, {"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}, {"platform": ["jetson_linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["jetson_linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}, {"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}, {"platform": ["jetson_linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "jetson_thor", "vendor": "nvidia"}, {"configurations": [{"platform": ["jetson_linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}, {"platform": ["Jetson Linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}, {"platform": ["jetson_linux(38)"], "status": "affected", "versions": {"scheme": "generic", "value": "38.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "jetson_xavier_series", "vendor": "nvidia"}], "analysis": {"en": {"generated_at": "2026-04-03T21:54:11.270292+00:00", "value": {"mitigation_remediation": ["Apply any available Jetson Linux firmware or kernel updates that address initrd parsing.", "If no update exists, limit the initrd\u2019s exposure by removing nonessential modules or restricting the arguments that can be parsed during boot.", "Physically secure the device and enforce secure boot to block unauthorized modifications to boot components.", "Verify the integrity of the initrd file with checksums or digital signatures before each startup.", "Monitor system logs for unexpected initrd activity or error messages that could indicate an attempt to inject commands."], "summary": {"action": "Immediate Patch", "impact": "Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw appears in NVIDIA Jetson devices from the Xavier, Orin, and Thor families. All variants listed in the CPE entries\u2014including the 32\u202fGB and 64\u202fGB models, developer and industrial editions, Orin\u202fNano, Orin\u202fNX, as well as the T4000 and T5000 workstations\u2014are susceptible. Jetson Linux distributions up to version\u202f38.2 are also affected.", "description_and_impact": "A malicious actor who can physically access an NVIDIA Jetson board can modify the boot initrd, causing the kernel to parse forged command line arguments. The initrd processes these arguments without proper validation, which allows arbitrary commands to run during the early boot stage. When successful, the attacker can execute code with elevated privileges, disrupt services, alter stored data, or exfiltrate confidential information.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.6, indicating high severity. The EPSS score is below 1\u202f%, suggesting that exploitation is not widespread yet, but the requirement of physical presence means a determined adversary can trigger the attack if they can reach the device. The flaw is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, implying that no publicly documented exploits have yet been found, but the potential impact warrants prompt remediation."}}}}, "created": "2026-03-31T19:53:57.779344+00:00", "updated": "2026-04-07T08:07:55.743769+00:00", "vendors": ["nvidia", "nvidia$PRODUCT$jetson_orin_series", "nvidia$PRODUCT$jetson_thor", "nvidia$PRODUCT$jetson_xavier_series"]}