CVE-2026-24154
Published: 31 March 2026
Summary
CVE-2026-24154 is a high-severity OS Command Injection (CWE-78) vulnerability in Nvidia Jetson Linux. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 PE-3 (Physical Access Control) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the OS command injection vulnerability in NVIDIA Jetson Linux initrd by applying vendor-provided patches and updates.
Prevents unauthorized physical access required for an unprivileged attacker to inject incorrect command line arguments during the boot process.
Enforces validation of command line arguments as external inputs to initrd, directly mitigating the CWE-78 OS command injection vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection during boot with physical access directly enables boot process manipulation (T1542 Pre-OS Boot) and privilege escalation via vulnerability exploitation (T1068).
NVD Description
NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and…
more
information disclosure.
Deeper analysisAI
CVE-2026-24154 is a vulnerability in the initrd component of NVIDIA Jetson Linux, stemming from CWE-78 (OS Command Injection). It allows an unprivileged attacker with physical access to inject incorrect command line arguments during the boot process. The issue received a CVSS v3.1 base score of 7.6 (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and was published on 2026-03-31.
An unprivileged attacker with physical access to the device can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation may result in arbitrary code execution, privilege escalation, denial of service, data tampering, or information disclosure, potentially compromising the entire system due to the changed scope.
Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5797, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24154, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24154. Security practitioners should consult these resources for patch information and recommended remediation steps.
Details
- CWE(s)