To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace.
An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCK_TAI and calling timer_settime(2), potentially disclosing sensitive kernel data.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Freebsd |
|
No data.
No data.
References
History
Wed, 26 Aug 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 19 Aug 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Freebsd
Freebsd freebsd |
|
| Vendors & Products |
Freebsd
Freebsd freebsd |
Wed, 19 Aug 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace. An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCK_TAI and calling timer_settime(2), potentially disclosing sensitive kernel data. | |
| Title | Kernel stack disclosure via timer_settime(2) | |
| Weaknesses | CWE-908 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: freebsd
Published: 2026-08-19T07:31:42.001Z
Updated: 2026-08-26T19:46:10.266Z
Reserved: 2026-06-29T01:40:17.498Z
Link: CVE-2026-58084
Vulnrichment
Updated: 2026-08-26T19:45:36.507Z
NVD
Status : Awaiting Analysis
Published: 2026-08-19T08:17:12.570
Modified: 2026-08-26T20:17:55.417
Link: CVE-2026-58084
Redhat
No data.