CVE-2026-58084

In FreeBSD 15.0 and 15.1, realtimer_gettime() returns an error for CLOCK_TAI timers when no TAI offset is configured, but the return value is unchecked and the uninitialized buffer is copied to userspace via timer_settime(2). An unprivileged local user can exploit this to read kernel stack memory...