Information disclosure can occur on NVIDIA Jetson Linux platforms when the initrd contains an enabled nvluks trusted application that should be disabled. The vulnerable component allows the extraction of sensitive data stored on the device, as the trust boundary is not properly enforced. This weakness corresponds to CWE‑501, where flaws in handling cryptographic material lead to leakage of confidential information.

The affected hardware includes the NVIDIA Jetson Xavier Series, Jetson Orin Series, and Jetson Thor family, all running Jetson Linux 38.2 and later. The vulnerability is present in the initrd image bundled with these devices, regardless of specific model or storage capacity. Any Jetson device that has not applied the latest firmware update is potentially vulnerable.

The CVSS score of 5.2 places this issue in the medium impact range. EPSS indicates a probability of exploitation below 1 %, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw resides in the boot/initrd stage, an attacker would need local or physical access to the device to tamper with or observe the initrd contents. Consequently, while the exploitation likelihood is low, the potential for confidential data exposure warrants prompt remediation.