NVIDIA Jetson Linux (UEFI): UEFI accepts a Linux Device Tree without checking authorization, so anyone who reaches

CVSS 7.6CVE-2025-33182NVIDIA / GPU stackcurated

Impact

UEFI accepts a Linux Device Tree without checking authorization, so anyone who reaches a privileged account on the device can rewrite the hardware description the kernel boots against. That is persistence below the operating system: the tampered DTB survives an OS reinstall, and a reimaged device comes back still owned. For a fleet of edge or embedded GPU devices this is the case where your standard recovery play - wipe and redeploy - does not actually clear the attacker.

Who can reach it

Requires an already-privileged account, but NVIDIA scores it as network-reachable, meaning the vulnerable update path is exposed to the device's privileged management surface rather than needing hands on the hardware. Realistically it is a second-stage move: chain any root-level bug into it and you convert a temporary foothold into firmware-level persistence.

What to do

Update Jetson Linux to 35.6.3 or later on Xavier and Orin. Separately, any device you suspect was reached at root needs a full firmware reflash and DTB verification, not an OS update - an in-place upgrade will not remove an already-planted Device Tree. Restrict who can reach the privileged management interface on these devices in the meantime.

References

https://github.com/NVIDIA/product-security/tree/main/2025/5716 https://nvd.nist.gov/vuln/detail/CVE-2025-33182

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.