NVIDIA Jetson initrd flaw lets attackers with physical access bypass Secure Boot
jedisct1 · x · 2026-09-04
ONEKEY Research Lab disclosed a command injection vulnerability in NVIDIA Jetson Linux's initrd: an unprivileged attacker with physical access can inject arbitrary commands during boot to bypass Secure Boot.
- Affected: Jetson Xavier, Orin and Thor series; Jetson For Linux versions 35.6.4, 36.5.0, 38.2.0/38.2.1, 38.4.0 and 39.2.0
- Fixed in: 35.6.5, 36.5.2 and 39.2.1
- Severity: CVSS 4.0 score of 7.0 (High), compromising confidentiality, integrity and availability
- Jetson powers security-sensitive edge devices like robots, drones, industrial machines and smart cameras; researchers urge patching and fusing signing keys
CVE IDs will be assigned when NVIDIA publishes its advisory.
More from Infra
- PostgreSQL 19 slips to November as LLM-assisted code review floods committers with edge cases — sanjaykalra · 2026-10-21
- Decision Models' routing classifier hits AntSeed, cutting inference cost to 24% of always-Opus — airesearch12 · 2026-10-21
- Eon cuts engineer onboarding from 2 days to 2 minutes with an MCP Gateway on Bedrock AgentCore — AWS ML Blog · 2026-10-20
- a16z's Ben Horowitz says AI buildout isn't the 90s bubble — an investor pushes back — henloitsjoyce · 2026-10-20
- Micron and Nvidia drive ~36% of S&P 500's Q3 earnings growth — Beth_Kindig · 2026-10-20
- NVIDIA lands in Europe: Jensen Huang and German chancellor discuss industrial AI at GTC Berlin — nvidia · 2026-10-20