CVE-2026-24154 is a vulnerability in NVIDIA Jetson Linux's initrd, allowing an unprivileged attacker with physical access to inject incorrect command line arguments. This flaw carries a CVSS score of 6.8 (Medium) due to its low attack complexity and severe potential impacts, including code execution, privilege escalation, denial of service, data tampering, and information disclosure. While requiring physical access, there is currently no evidence of active exploitation, no public exploit code, and it is not on the CISA KEV catalog, with a very low EPSS score indicating minimal probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 35.6.4CPE matchmatch criteria | cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:* | ||
>= 36.0, < 36.5CPE matchmatch criteria | cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:* | ||
38.2CPE matchmatch criteria | cpe:2.3:o:nvidia:jetson_linux:38.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.