---
id: "CVE-2013-6282"
kind: "vulnerability"
aliases: ["CVE-2013-6282"]
title: "The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do\u2026"
severity: "high"
cvss: 8.8
epss: 0.39711
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "linux kernel", "fixed": ["3.2.54"], "affected": "< 3.2.54", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.4.12"], "affected": ">= 3.3, < 3.4.12", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.5.5"], "affected": ">= 3.5, < 3.5.5", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["arm", "embedded", "exploited", "infrastructure", "linux"]
not_affected_if: ["non-arm-platform", "x86-only-hosts"]
published_at: "2013-11-20T13:19:43+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-6282", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6282", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6282", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do…

The Linux kernel's get_user and put_user functions do not validate the target address on ARM v6k and v7 platforms. A local application can read and write kernel memory, which can lead to privilege escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:linux kernel affected < 3.2.54 fixed 3.2.54
- vendor:linux kernel affected >= 3.3, < 3.4.12 fixed 3.4.12
- vendor:linux kernel affected >= 3.5, < 3.5.5 fixed 3.5.5
- vendor:Linux Kernel affected ? fixed ?

## Fix

Apply the kernel update from your vendor or distribution that fixes CVE-2013-6282 (CISA: apply updates per vendor instructions).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-6282
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-6282
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-6282

## From the sources

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_