CVE-2024-0108 is a high severity (CVSS 8.7) flaw in the NvGPU driver of NVIDIA Jetson Linux. Error handling in the GPU MMU mapping code fails to clean up a failed mapping attempt. NVIDIA lists versions up to and including 32.7.4 as affected and 32.7.5 as the fixed release.
What's affected
NVIDIA bulletin 5555 lists Jetson Linux versions up to and including 32.7.4 as affected, and says earlier releases are also affected. The fixed version is 32.7.5.
Affected products named in the bulletin are the Jetson AGX Xavier series, Xavier NX, TX2 series including TX2 NX, TX1, and the Nano series including Nano 2GB. NVIDIA says its risk assessment is an average across many systems and may not reflect the risk to a specific install.
How to check if you're exposed
On a Jetson device, read the release information.
cat /etc/nv_tegra_release
The first line shows the L4T release and revision, which you can map to the Jetson Linux version. Devices in the field often run old images, so also check your fleet management records and the image used to flash each batch.
What to do now
- List Jetson devices and the Jetson Linux release each one runs.
- Plan an update to 32.7.5 or later, by reflashing or using your over the air update path.
- Until updated, limit local access and untrusted workloads on devices that cannot be updated yet.
- Update your base image so new devices ship with the fixed release.
Why it matters
The weakness is CWE-755, improper handling of exceptional conditions. When a mapping attempt fails, the code does not undo what it already did, which leaves state in the GPU memory management layer that it should have cleaned up. NVIDIA lists denial of service, code execution and escalation of privileges as possible impacts.
The vector is local with low privileges and a changed scope, giving 8.7. Embedded devices are often deployed for years without updates, so the practical risk is a long tail of old images. The record does not show exploitation in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Which version fixes it?
NVIDIA lists Jetson Linux 32.7.5.
Does it affect all Jetson boards?
The bulletin names the AGX Xavier, Xavier NX, TX2, TX1 and Nano families that run this Jetson Linux line.
Sources
Last reviewed: 19 October 2026.
