high 7.8

CVE-2013-2596 kev in the critical feed json

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of…

published 2013-04-13 13y ago modified 2026-06-16 4mo ago also EUVD-2013-2538

cvss: 7.8; version 3.1, CNA
cisa kev: Exploited; added 2022-09-15
epss: 3.2%; EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits: 0; none known

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1 distros 2 links 4

linux linux_kernel 3.0.75, 3.2.45, 3.4.42, 3.8.9

debian red hat

linux Debian 14, Debian 13, Debian 12 3.9-1

debian advisories DEBIAN-CVE-2013-2596

kernel RHEL 5 2.6.18-409.el5
kernel-PAE RHEL 5 2.6.18-409.el5
kernel-xen RHEL 5 2.6.18-409.el5
kernel-kdump RHEL 5 2.6.18-409.el5
kernel-debuginfo-common RHEL 5 2.6.18-409.el5
kernel RHEL 6 2.6.32-504.el6
perf RHEL 6 2.6.32-504.el6
python-perf RHEL 6 2.6.32-504.el6

red hat advisories RHSA-2016:0450 RHSA-2015:0695 RHSA-2015:0782 RHSA-2015:0803 RHSA-2014:1392

github.com/torvalds/linux@b4cbb19 commit
github.com/torvalds/linux@fc9bbca commit
marc.info/?l=linux-kernel&m=136616837923938&w=2 advisory
oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.h… advisory

Is CVE-2013-2596 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-2596 updated 2026-11-04 cvss 6.0

kernel: integer overflow in fb_mmap

Red Hat Enterprise Linux (v. 5 server) kernel 2.6.18-409.el5, kernel-PAE 2.6.18-409.el5, kernel-xen 2.6.18-409.el5, kernel-kdump 2.6.18-409.el5, kernel-debuginfo-common 2.6.18-409.el5
fixed: vendor fix RHSA-2016:0450
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5) kernel 2.6.32-431.53.2.el6, python-perf 2.6.32-431.53.2.el6, kernel-debuginfo-common-x86_64 2.6.32-431.53.2.el6
fixed: vendor fix RHSA-2015:0782
Red Hat Enterprise Linux Desktop (v. 5 client) kernel 2.6.18-409.el5, kernel-PAE 2.6.18-409.el5, kernel-xen 2.6.18-409.el5, kernel-debuginfo-common 2.6.18-409.el5
fixed: vendor fix RHSA-2016:0450
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-504.el6, kernel 2.6.32-504.el6, kernel-firmware 2.6.32-504.el6, kernel-abi-whitelists 2.6.32-504.el6, kernel-debuginfo-common-i686 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-504.el6, kernel-debuginfo-common-i686 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6 Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-504.el6, kernel 2.6.32-504.el6, kernel-firmware 2.6.32-504.el6, kernel-abi-whitelists 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6
fixed: vendor fix RHSA-2014:1392
Red Hat Enterprise Linux HPC Node EUS (v. 6.5) perf 2.6.32-431.53.2.el6, kernel 2.6.32-431.53.2.el6, kernel-firmware 2.6.32-431.53.2.el6, kernel-abi-whitelists 2.6.32-431.53.2.el6, kernel-debuginfo-common-x86_64 2.6.32-431.53.2.el6
fixed: vendor fix RHSA-2015:0782
Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6 Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-504.el6, kernel 2.6.32-504.el6, kernel-kdump 2.6.32-504.el6, kernel-firmware 2.6.32-504.el6, kernel-bootwrapper 2.6.32-504.el6, kernel-abi-whitelists 2.6.32-504.el6, +4 more
fixed: vendor fix RHSA-2014:1392
Red Hat Enterprise Linux Server AUS (v. 6.2) perf 2.6.32-220.60.2.el6, kernel 2.6.32-220.60.2.el6, kernel-firmware 2.6.32-220.60.2.el6, kernel-debuginfo-common-x86_64 2.6.32-220.60.2.el6
fixed: vendor fix RHSA-2015:0695
Red Hat Enterprise Linux Server AUS (v. 6.4) perf 2.6.32-358.59.1.el6, kernel 2.6.32-358.59.1.el6, kernel-firmware 2.6.32-358.59.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.59.1.el6
fixed: vendor fix RHSA-2015:0803

show 7 more

Red Hat Enterprise Linux Server EUS (v. 6.5) perf 2.6.32-431.53.2.el6, kernel 2.6.32-431.53.2.el6, kernel-kdump 2.6.32-431.53.2.el6, kernel-firmware 2.6.32-431.53.2.el6, kernel-bootwrapper 2.6.32-431.53.2.el6, kernel-abi-whitelists 2.6.32-431.53.2.el6, +4 more
fixed: vendor fix RHSA-2015:0782
Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-504.el6, kernel-debuginfo-common-i686 2.6.32-504.el6, kernel-debuginfo-common-ppc64 2.6.32-504.el6, kernel-debuginfo-common-s390x 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6
fixed: vendor fix RHSA-2014:1392
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) kernel 2.6.32-220.60.2.el6, python-perf 2.6.32-220.60.2.el6, kernel-debuginfo-common-x86_64 2.6.32-220.60.2.el6
fixed: vendor fix RHSA-2015:0695
Red Hat Enterprise Linux Server Optional AUS (v. 6.4) kernel 2.6.32-358.59.1.el6, python-perf 2.6.32-358.59.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.59.1.el6
fixed: vendor fix RHSA-2015:0803
Red Hat Enterprise Linux Server Optional EUS (v. 6.5) kernel 2.6.32-431.53.2.el6, python-perf 2.6.32-431.53.2.el6, kernel-debuginfo-common-i686 2.6.32-431.53.2.el6, kernel-debuginfo-common-ppc64 2.6.32-431.53.2.el6, kernel-debuginfo-common-s390x 2.6.32-431.53.2.el6, kernel-debuginfo-common-x86_64 2.6.32-431.53.2.el6
fixed: vendor fix RHSA-2015:0782
Red Hat Enterprise Linux Workstation (v. 6) perf 2.6.32-504.el6, kernel 2.6.32-504.el6, kernel-firmware 2.6.32-504.el6, kernel-abi-whitelists 2.6.32-504.el6, kernel-debuginfo-common-i686 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6 Red Hat Enterprise Linux Workstation Optional (v. 6) python-perf 2.6.32-504.el6, kernel-debuginfo-common-i686 2.6.32-504.el6, kernel-debuginfo-common-x86_64 2.6.32-504.el6
fixed: vendor fix RHSA-2014:1392
Red Hat Enterprise Linux 7 perf, kernel, bpftool, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2013-04-13 Published
2022-09-15 Added to CISA KEV
2022-10-06 CISA patch deadline
2025-05-01 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-09-15)
Patch by: 2022-10-06 (4y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Linux, Kernel
CISA name: Linux Kernel Integer Overflow Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: last yr. (2025-05-01)

Exploit prediction

3.21% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a referenced PoC, tagged "exploit" by a source, unverified
droid-life.com http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/ referenced PoC, tagged "exploit" by a source, unverified
forum.xda-developers.com http://forum.xda-developers.com/showthread.php?t=2255491 referenced PoC, tagged "exploit" by a source, unverified
droidrzr.com http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

Technology feeds

Linux kernel rss critical rss

References

github.com /torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e
patch
github.com /torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a
exploit, patch
marc.info /?l=linux-kernel&m=136616837923938&w=2
mailing-list, patch, third-party-advisory
oracle.com /technetwork/topics/security/linuxbulletinjan2016-2867209.html
patch, third-party-advisory
droid-life.com /2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/
exploit, issue-tracking, third-party-advisory
forum.xda-developers.com /showthread.php?t=2255491
exploit
droidrzr.com /index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/
exploit, issue-tracking
rhn.redhat.com /errata/RHSA-2015-0695.html
vendor-advisory, third-party-advisory
mandriva.com /security/advisories?name=MDVSA-2013:176
vendor-advisory, broken-link
rhn.redhat.com /errata/RHSA-2015-0803.html
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2015-0782.html
vendor-advisory, third-party-advisory
securityfocus.com /bid/59264
vdb-entry, broken-link, third-party-advisory
git.kernel.org /?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3ca67420c13e
broken-link
kernel.org /pub/linux/kernel/v3.x/ChangeLog-3.8.9
mailing-list, release-notes
kb.juniper.net /InfoCenter/index?page=content&id=JSA10761
third-party-advisory
git.kernel.org /?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc9bbca8f650e5f738af8806317c0a041a48ae4a
broken-link
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2596
government-resource, us-government-resource

Sources

CVE List CVE-2013-2596
NVD CVE-2013-2596

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed