A malicious actor who can physically access an NVIDIA Jetson board can modify the boot initrd, causing the kernel to parse forged command line arguments. The initrd processes these arguments without proper validation, which allows arbitrary commands to run during the early boot stage. When successful, the attacker can execute code with elevated privileges, disrupt services, alter stored data, or exfiltrate confidential information.

The flaw appears in NVIDIA Jetson devices from the Xavier, Orin, and Thor families. All variants listed in the CPE entries—including the 32 GB and 64 GB models, developer and industrial editions, Orin Nano, Orin NX, as well as the T4000 and T5000 workstations—are susceptible. Jetson Linux distributions up to version 38.2 are also affected.

The vulnerability carries a CVSS score of 7.6, indicating high severity. The EPSS score is below 1 %, suggesting that exploitation is not widespread yet, but the requirement of physical presence means a determined adversary can trigger the attack if they can reach the device. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, implying that no publicly documented exploits have yet been found, but the potential impact warrants prompt remediation.