CVE-2026-24148 is a high severity flaw (CVSS 8.3) in NVIDIA Jetson Linux, in the system initialization logic, where a resource is created with an insecure default. It can expose encrypted data and allow tampering across devices that share the same machine ID. NVIDIA fixed it in Jetson Linux 35.6.4 and 36.5.
What's affected
Jetson Xavier and Orin series devices running Jetson Linux, per NVIDIA's March 2026 bulletin. All versions before 35.6.4 on the 35 branch and before 36.5 on the 36 branch are affected. The record lists several Jetson AGX Orin models among the products.
How to check if you're exposed
On the device:
cat /etc/nv_tegra_release
This prints the Jetson Linux release. Compare it with 35.6.4 and 36.5. Also look at your provisioning process: if devices are cloned from one image, or flashed with the same machine ID, the cross-device effect described in the record applies to your fleet.
What to do now
- Update Jetson Linux to 35.6.4 or 36.5 or later, using the APT server or the Jetson download center as the bulletin describes.
- Make sure each device has a unique machine ID, and fix provisioning that clones it.
- Review where encrypted data on these devices is protected by keys tied to the machine identity.
- Limit physical and local access to the devices, since the vector requires local access.
Why it matters
The weakness is CWE-1188, insecure default initialization of a resource. Defaults run on every device the same way. If the default is unsafe, so is every unit that was set up with it.
Fleets of embedded devices are slow to update, so tracking which release each device runs matters. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 8.3, published 2026-03-31. In the vector, the attacker works over the network, needs a low privilege account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability low.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Is a single device affected on its own?
The description focuses on effects across devices that share the same machine ID, so duplicated identities raise the risk. Update every device anyway.
Sources
Last reviewed: 19 October 2026.
