# CVE-2026-24154: NVIDIA Jetson Linux command injection in initrd

Source: https://junglewise.ai/threats/cve-2026-24154-nvidia-jetson-linux-command-injection-in-initrd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-24154 · Severity: high · CVSS 7.6 · Published 2026-03-31

NVIDIA Jetson Linux, the operating system used in Jetson Xavier, Orin, and Thor hardware modules, contains a security flaw in its initial boot process. An attacker with physical access to the device can manipulate startup commands to gain full control over the system. This could lead to the theft of sensitive data, permanent tampering with the device's software, or a complete shutdown of operations.

Technologies: [Nvidia Jetson Linux](https://junglewise.ai/threats/technologies/jetson-linux). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24154 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24154 being exploited in the wild.

**How severe is CVE-2026-24154?** High severity, with a CVSS score of 7.6, published 31 March 2026.

**Which products and versions are affected?** Nvidia Jetson Linux All versions prior to 35.6.4.

**Is there a fix for CVE-2026-24154?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24154 attacked?** It is attacked with physical access, in an operating system.

**Am I affected by CVE-2026-24154?** Check whether you run Nvidia Jetson Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-78) exists in the initial RAM disk (initrd) of NVIDIA Jetson Linux. An unprivileged attacker with physical access to the hardware can inject malicious command-line arguments during the boot sequence. This bypasses standard security controls, potentially leading to arbitrary code execution, privilege escalation to root, and full system compromise. The vulnerability affects Jetson Xavier, Orin, and Thor series modules. NVIDIA has released patches in Jetson Linux versions 35.6.4 and 36.5 to address this issue.

## Affected products

- NVIDIA Jetson Linux (35.x) All versions prior to 35.6.4
- NVIDIA Jetson Linux (36.x) All versions prior to 36.5
- NVIDIA Jetson Linux (38.x) 38.2

## Timeline

- 2026-03-31: disclosed
- 2026-03-31: advisory

## References

- [https://nvidia.custhelp.com/app/answers/detail/a_id/5797](https://nvidia.custhelp.com/app/answers/detail/a_id/5797)
- [https://www.cve.org/CVERecord?id=CVE-2026-24154](https://www.cve.org/CVERecord?id=CVE-2026-24154)

## Related threats

- [NVIDIA Jetson Linux information disclosure in initrd](https://junglewise.ai/threats/cve-2026-24153-nvidia-jetson-linux-information-disclosure-in-initrd)
- [NVIDIA Jetson insecure default initialization in system logic](https://junglewise.ai/threats/cve-2026-24148-nvidia-jetson-insecure-default-initialization-in-system-logic)