JetPack releases with Security Fixes: CVE-2025-33182 & CVE-2025-33177

Robotics & Edge Computing Jetson Systems Jetson AGX Orin
1

NVIDIA has released security updates addressing a specific vulnerability detailed in this security bulletin. These fixes are now available for JetPack 5, JetPack 6, and JetPack 7.

Updates have been made available on the Jetson Debian package management server for each JetPack branch, allowing developers to easily download and apply the security patches to their developer kits. In addition, updates have been pushed to the relevant kernel source repositories, enabling customers to integrate the fixes into their own kernel builds.

Note that in order to get the fixes, you can either “apt upgrade” on your developer kit or compile the kernel from the kernel sources.

JetPack 7

  • Jetson Linux BSP updated to version 38.2.2, a minor release over 38.2.1 focused on this security fix.

JetPack 6

  • Jetson Linux BSP updated to version 36.4.7, a minor update following 36.4.4 that includes this security patch.

  • Note: Jump from 36.4.4 to 36.4.7 for Jetpack release was because the versions 36.4.5 and 36.4.6 was used for IGX product line releases (they dont apply to Jetson).

  • Note: Since the 36.4.7 update, a number of camera issues have been reported. The team is aware of this and will update the thread as soon as more information is available. If you are encountering camera issues since the upgrade, please revert to 36.4.4.

JetPack 5

  • Jetson Linux BSP updated to version 35.6.3, a minor update over 35.6.2 that incorporates this security fix.

This announcement was delayed by few days waiting on the publishing of the security bulletin. Corresponding JetPack pages will be updated to mention the new releases.

JETPACK l4t 36.4.7
After L4T 36.4.7 upgrade from 36.4.3, i see 3 different jetpack in my machine, how to fix?
Strange update and its impacts
Jetson 35.6.3
3

When can we expect the inclusion of R36.4.7 on the Linux Archive page?

4 Likes
4

Hello,

Thank you for posting this. I will bookmark this security bulletin board as I didnt know about it previously.

Quick question, with this security bulletin and related fixes for 36.4.4, will there be new .tar and checksums be updated here soon?

https://developer.download.nvidia.com/embedded/L4T/r36_Release_v4.4/release/release_sha_hashes.txt?t=eyJscyI6ImdzZW8iLCJsc2QiOiJodHRwczovL3d3dy5nb29nbGUuY29tLyJ9

2 Likes
5

I am also interested in knowing where the .tar and checksums of 36.4.7 will be made available.

3 Likes
6

Same for 35.6.3 including tags in UEFI repo.

1 Like
7

Hi,
Any update on this?

1 Like
8

Also waiting…

Looks like nvidia’s trainee that should have acted like a ci/cd left the company and they are waiting to hire the next trainee to build a release package ?

3 Likes
9

Ping!

10

Hi,
The fix for CVE-2025-33177 triggers a side effect. We are working on it. Will update once there is a stable fix.

11

Hello @suhash , you note reported camera issues for the 36.4.7 update.
What type of issues are you talking about exactly, are nvargus camera devices affected?
Are any of these issues reported here in the forum?

Thank you in advance!

12

Hi,
A user reports there might be potential issue:
JETPACK l4t 36.4.7 - #7 by seerich-edge

However, we don’t observe it in our SQA validation. If you hit any camera issues, please create a new topic and share us the steps. We will set up developer kit and check.

13

Hello.
When will R36.4.7 appear on the Linux Archive page?

3 Likes
14

I second this. Yes, please update the Jetson Linux Archive | NVIDIA Developer page with 36.4.7 when possible. Thanks in advance!

1 Like
15

Still no news? Trying to get Longhorn to work in a k3s cluster. The iscsi_tcp module is not included, so I need to build the kernel. Can I use the 36.4.4 BSP?