What is the CVSS score of CVE-2026-24153?

CVE-2026-24153 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Nvidia CVE-2026-24153

EUVD-2026-17512 MEDIUM

Trust Boundary Violation (CWE-501)

2026-03-31 nvidia

Information Disclosure Nvidia

5.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.2 MEDIUM

AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 17:16 euvd

EUVD-2026-17512

Analysis Generated

Mar 31, 2026 - 17:16 vuln.today

CVE Published

Mar 31, 2026 - 16:23 nvd

MEDIUM 5.2

DescriptionCVE.org

NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

Information disclosure in NVIDIA Jetson Linux affects Xavier, Orin, and Thor series devices due to the nvluks trusted application remaining enabled in initrd. A local attacker with physical access and low-level privileges can exploit this to read sensitive data from the device, as confirmed by CWE-501 (CLS: Malicious Code Not Included in Executable) indicating improper access control to privileged components. CVSS 5.2 reflects the high confidentiality impact but requires physical attack vector and authenticated access; no public exploit or CISA KEV status reported.

Technical ContextAI

NVIDIA Jetson devices rely on a trusted execution environment (TEE) with a specialized trusted application (TA) called nvluks for handling encrypted storage and cryptographic operations. The vulnerability stems from CWE-501, indicating that security-critical code (the nvluks TA) lacks proper disablement controls in the initrd boot image, allowing lower-privileged local contexts to interact with sensitive cryptographic or key-management functionality. The affected CPE entries span the Jetson Xavier series (Xavier, Xavier NX, AGX Xavier, Orin variants), Orin series (Orin, Orin Nano, Orin NX, AGX Orin), and Jetson Thor-all of which use the same initrd architecture for early boot trust establishment.

RemediationAI

Update NVIDIA Jetson Linux to a patched version that disables the nvluks trusted application in initrd by default or removes its active invocation during early boot. Check the official NVIDIA security advisory (https://nvidia.custhelp.com/app/answers/detail/a_id/5797) for the specific patched Jetson Linux version applicable to your device variant (Xavier, Orin, or Thor series). If immediate patching is unavailable, physically restrict access to devices and disable or constrain TEE-based cryptographic services where operationally feasible. Verify remediation by inspecting the initrd image to confirm nvluks invocation has been disabled.