FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Kernel stack disclosure via timer_settime(2)

Affected packages
15.1 <= FreeBSD-kernel < 15.1_2
15.0 <= FreeBSD-kernel < 15.0_12

Details

VuXML ID eab90fc5-8bb7-11f1-a6ab-bc241121aa0a
Discovery 2026-07-29
Entry 2026-07-30

Problem Description:

To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace.

Impact:

An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCK_TAI and calling timer_settime(2), potentially disclosing sensitive kernel data.

References

CVE Name CVE-2026-58084
FreeBSD Advisory SA-26:51.ktimer