EUVD-2026-17512Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.
AnalysisAI
Information disclosure in NVIDIA Jetson Linux affects Xavier, Orin, and Thor series devices due to the nvluks trusted application remaining enabled in initrd. A local attacker with physical access and low-level privileges can exploit this to read sensitive data from the device, as confirmed by CWE-501 (CLS: Malicious Code Not Included in Executable) indicating improper access control to privileged components. CVSS 5.2 reflects the high confidentiality impact but requires physical attack vector and authenticated access; no public exploit or CISA KEV status reported.
Technical ContextAI
NVIDIA Jetson devices rely on a trusted execution environment (TEE) with a specialized trusted application (TA) called nvluks for handling encrypted storage and cryptographic operations. The vulnerability stems from CWE-501, indicating that security-critical code (the nvluks TA) lacks proper disablement controls in the initrd boot image, allowing lower-privileged local contexts to interact with sensitive cryptographic or key-management functionality. The affected CPE entries span the Jetson Xavier series (Xavier, Xavier NX, AGX Xavier, Orin variants), Orin series (Orin, Orin Nano, Orin NX, AGX Orin), and Jetson Thor-all of which use the same initrd architecture for early boot trust establishment.
RemediationAI
Update NVIDIA Jetson Linux to a patched version that disables the nvluks trusted application in initrd by default or removes its active invocation during early boot. Check the official NVIDIA security advisory (https://nvidia.custhelp.com/app/answers/detail/a_id/5797) for the specific patched Jetson Linux version applicable to your device variant (Xavier, Orin, or Thor series). If immediate patching is unavailable, physically restrict access to devices and disable or constrain TEE-based cryptographic services where operationally feasible. Verify remediation by inspecting the initrd image to confirm nvluks invocation has been disabled.
Same weakness CWE-501 – Trust Boundary Violation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today