A flaw in NVIDIA Jetson Linux initrd keeps the nvluks trusted application enabled by default. This misconfiguration allows an attacker to view data that is meant to be protected, resulting in potential leakage of sensitive information. The weakness is classified as CWE‑501, insecure default configuration leading to information exposure.

The vulnerability affects NVIDIA Jetson devices built on the Xavier Series, Orin Series, and Thor models. No specific firmware or OS versions are listed, so any device that includes the affected initrd and leaves the nvluks trusted application enabled is potentially susceptible.

The CVSS score of 5.2 indicates moderate severity. EPSS data is not provided, so the likelihood of exploitation cannot be quantified. The likely attack vector requires an adversary with physical access or the ability to modify firmware to manipulate the initrd environment. The issue is not included in the CISA Known Exploited Vulnerabilities catalog, suggesting no known public exploitation. Nevertheless, the disclosure of protected data is a significant risk and should be mitigated promptly.