CVE-2026-58084 Kernel stack disclosure via timer_settime(2)

To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...

CVE-2026-58084

FreeBSD 15.0 and 15.1 are affected by a kernel stack disclosure in the POSIX interval timer subsystem (ktimer). When an unprivileged local user calls timer_settime(2) with a non-NULL old_value argument on a CLOCK_TAI timer, the kernel invokes realtimer_gettime() to retrieve the previous timer val...