The CVE details a flaw in the initrd of NVIDIA Jetson Linux that allows an attacker with physical access to supply malformed command line arguments during boot. This misconfiguration permits injection of arbitrary commands that can be executed with root privileges, leading to code execution, privilege escalation, denial of service, data tampering, and disclosure of sensitive information. The weakness is classed as OS command injection (CWE‑78).

The vulnerability affects NVIDIA Jetson devices including the Xavier Series, Orin Series, and Thor. No specific affected firmware or hardware revisions are listed, so all current models remain potentially vulnerable until patched.

The CVSS score of 7.6 indicates a high severity level. The lack of an EPSS score and absence from the KEV catalog suggest the exploit has not been widely seen in the wild yet, but the local physical access requirement reduces the attack surface. Nevertheless, once an attacker reaches the device, executing malicious commands from the initrd can compromise the entire system. Administrators should treat this as a critical risk while the device is physically exposed.