Toggle sidebar

Hacking Speculations about Switch 2 hacking

[Research] CVE-2025-10263 (ARM Erratum 4193794) & Potential Kernel Escalation on Switch 2

starbucks-c · 2026-08-30T14:28:07+00:00

The Nintendo Switch 2 relies on the Nvidia Tegra T239 SoC, which uses ARM Cortex-A78C cores. Because CVE-2025-10263 (ARM Erratum 4193794) is an erratum baked directly into the physical Cortex-A78C silicon due to a flaw in the RTL, the CPU cores most likely contain the microarchitectural flaw at launch, which can cause issues in the translation lookaside buffer (TLB), hence causing a privilage escalation leading to a potential kernel-exploit (EL0->EL1), so basically a flaw in the RTL logic in the LSU&interconnect causing a race condition which also might lead to a privilege escalation in the execution layers of the ARM-Architecture, which the nintendo switch 2 corresponds by. As this vulnerability was discovered around november 2025& got fixed in June 2026 so after the release of the nintendo switch 2, the vulnerability should be there at least in the current revision. During multi-core memory operations, a Data Synchronization Barrier (DSB IS) completes prematurely before a secondary core flushes pending writes from its internal Store Buffer following a broadcast Translation Lookaside Buffer Invalidate (TLBI IS). Starting from an underprivileged entry point such as the Userland Base, especially when bypassed the ARM-PAC like Gezine demonstrated on X, there is a high probability of CVE-2025-10263 affecting the Nintendo Switch 2. Affected Nintendo Switch 2 Firmwares: Every firmware supporting Switch 1/2 backwards compatibility released before June 2026 (up to firmware 22.1.0) Sources: https://www.openwall.com/lists/oss-security/2026/06/09/13 https://access.redhat.com/security/cve/cve-2025-10263?extIdCarryOver=true&sc_cid=RHCTG0180000382538?extIdCarryOver=true&sc_cid=RHCTG0180000382538 https://support.arm.com/documentation/SDEN-2004089/14-0?lang=en&rev=14.0 https://support.arm.com/documentation/112137/1-0/ Gezine’s Userland Exploit:

Thread starter KeeperCP1
Start date Jan 16, 2025
Views 361,515
Replies 1,044
Likes 11

hippy dave

BBMB

Member

Level 52

Saturday at 4:07 PM

#1,041

SecureBoot said:
Overruled: you have no whimsy

NO WHIMMMMMMMMSY? HOW VERY DARE!

MRJPGames

Pretty great guy

Member

Ace Attorney Fan 💩

Level 10

Sunday at 8:19 PM

#1,042

DigBar said:
son trying to act tuff, yet he spelled "listening" wrong

tough*

Reactions: Newhouse-Estates and impeeza

TomSwitch

Well-Known Member

Member

Level 32

Yesterday at 1:52 AM

#1,043

https://www.nytimes.com/2026/09/09/opinion/openai-ai-companies-safety-regulation.html

Will AI hack Switch 2 before AI kill all humans?

Will AI continue to hack Switch 2 after AI kill all humans?

Last edited by TomSwitch, Yesterday at 2:01 AM

Reactions: hippy dave, impeeza and BigOnYa

purple_bandit

Well-Known Member

Member

Level 5

58 minutes ago

#1,044

Nintendo patched using a Mario Kart RC toy to scan QR codes to run code?

Imagine that was discovered to how to hack switch 2.

RyanTheArchivist

Well-Known Member

Member

Level 17

15 minutes ago

#1,045

purple_bandit said:
Nintendo patched using a Mario Kart RC toy to scan QR codes to run code?

Imagine that was discovered to how to hack switch 2.

You won't get anything more than what we already have from a game exploit I'm afraid. In fact we'd get less. Goes into the pile of dozens of things that could possibly be used to trigger a kernel exploit but is useless on its own.