CVE-2013-7446

21

FAUCET Score

CVE-2013-7446 is a use-after-free vulnerability in the Linux kernel's AF_UNIX socket implementation (net/unix/af_unix.c) affecting versions prior to 4.3.3. This flaw allows local attackers to bypass socket permissions or trigger a denial of service (system panic) through specially crafted epoll_ctl calls. Rated Medium (CVSS 5.3), exploitation requires local access and high attack complexity, primarily impacting system availability and potentially integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this vulnerability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 4.3.2CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::

CVSS Data

CVSS version used by this source: 3.0

5.3MEDIUM

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

Exploitability Score

1.0

Impact Score

4.2

CvssVersion

3.0

Exploit Intelligence

EPSS Score

0.63%

Probability of exploitation in next 30 days

EPSS Percentile

46.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0063 is in the 88th percentile among its peer group of 1,297 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (5)

github_advisoryvendor investigatingvia nvd_reference

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: kernel

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: kernel

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: kernel

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: kernel-rt

Vendor Advisories (1)

redhatCVE-2013-7446Moderate

kernel: Unix sockets use after free - peer_wait_queue prematurely freed

References

git.kernel.org / cgit/linux/kernel/git/torvalds/linux.git/commit

lists.opensuse.org / opensuse-security-announce/2016-03/msg00033.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00034.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00035.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00037.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00038.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00039.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00040.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00041.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00042.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00043.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00044.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00045.html

lists.opensuse.org / opensuse-security-announce/2016-03/msg00094.html

lists.opensuse.org / opensuse-security-announce/2016-04/msg00045.html

lists.opensuse.org / opensuse-security-announce/2016-06/msg00044.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00003.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00008.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00009.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00014.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00015.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00016.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00017.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00018.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00019.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00020.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00021.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00022.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00023.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00026.html

lists.opensuse.org / opensuse-security-announce/2016-08/msg00038.html

bugzilla.redhat.com / show_bug.cgi

forums.grsecurity.net / viewtopic.php

github.com / torvalds/linux/commit/7d267278a9ece963d77eefec61630223fce08c6c

Vendor Advisory

groups.google.com / forum

lkml.org / lkml/2013/10/14/424

Exploit

lkml.org / lkml/2014/5/15/532

Exploit

lkml.org / lkml/2015/9/13/195

Exploit

debian.org / security/2015/dsa-3426

kernel.org / pub/linux/kernel/v4.x/ChangeLog-4.3.3

Vendor Advisory

openwall.com / lists/oss-security/2015/11/18/16

securityfocus.com / bid/77638

securitytracker.com / id/1034557

spinics.net / lists/netdev/msg318826.html

Exploit

ubuntu.com / usn/USN-2886-1

ubuntu.com / usn/USN-2887-1

ubuntu.com / usn/USN-2887-2

ubuntu.com / usn/USN-2888-1

ubuntu.com / usn/USN-2889-1

ubuntu.com / usn/USN-2889-2

ubuntu.com / usn/USN-2890-1

ubuntu.com / usn/USN-2890-2

ubuntu.com / usn/USN-2890-3