CVE-2026-58084: Linux Kernel Information Disclosure Flaw

CVE-2026-58084 Overview

CVE-2026-58084 is an information disclosure vulnerability in the FreeBSD kernel timer subsystem. The flaw resides in the handling of POSIX timers configured with the CLOCK_TAI clock identifier. When the kernel retrieves the previous timer value through realtimer_gettime(), it does not verify the return status before copying the output buffer to userspace. If no TAI offset has been configured, the call fails and leaves the buffer uninitialized, exposing kernel stack memory to the caller.

The issue is categorized under CWE-908: Use of Uninitialized Resource. Any unprivileged local user can trigger the flaw by creating a POSIX timer with CLOCK_TAI and invoking timer_settime(2).

Critical Impact
An unprivileged local user can read uninitialized kernel stack memory, potentially disclosing sensitive kernel data such as pointers, credentials, or cryptographic material that undermines kernel address space layout randomization.

Affected Products

FreeBSD operating system versions with the ktimer subsystem supporting CLOCK_TAI
Systems using POSIX timer interfaces timer_create(2) and timer_settime(2)
Refer to the FreeBSD Security Advisory FreeBSD-SA-26:51.ktimer for the authoritative list of affected releases

Discovery Timeline

2026-08-19 - CVE-2026-58084 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-58084

Vulnerability Analysis

The vulnerability exists in the FreeBSD kernel's POSIX interval timer implementation. When userspace calls timer_settime(2), the kernel must return the previous timer value in the ovalue output argument. To populate this argument, the kernel invokes realtimer_gettime(), which reads the current time for the timer's associated clock source.

For timers created with CLOCK_TAI (International Atomic Time), obtaining the current time requires a valid TAI offset relative to CLOCK_REALTIME. If the administrator has not configured a TAI offset, the underlying time retrieval function returns an error. The calling code, however, does not check this return value. The kernel proceeds to copy the on-stack struct itimerspec buffer to userspace despite it never being initialized with valid data.

Because the buffer resides on the kernel stack, it contains residual data from prior kernel activity. This residual data may include return addresses, saved registers, pointers into kernel memory, or fragments of privileged data structures processed in earlier syscalls on the same CPU.

Root Cause

The root cause is a missing error check on the return value of realtimer_gettime() in the timer_settime code path. Correct handling requires either zero-initializing the output buffer before the call or aborting the copy-to-userspace operation when the time retrieval fails.

Attack Vector

Exploitation requires local, unprivileged code execution on the target host. An attacker calls timer_create(2) with CLOCK_TAI, then calls timer_settime(2) with a non-NULL ovalue pointer on a system that has not configured a TAI offset. The returned itimerspec structure contains uninitialized kernel stack bytes that the attacker reads directly from the userspace buffer. Repeated invocations can be used to sample kernel stack contents and defeat mitigations such as kernel address randomization.

No verified public proof-of-concept code has been published. See the FreeBSD Security Advisory for technical details.

Detection Methods for CVE-2026-58084

Indicators of Compromise

Unexpected use of timer_create(2) with the CLOCK_TAI clock identifier by non-system processes
High-frequency repeated invocations of timer_settime(2) from a single unprivileged process, consistent with kernel memory sampling
Unprivileged processes issuing POSIX timer syscalls outside their normal operational profile

Detection Strategies

Enable dtrace or audit(4) on FreeBSD hosts to log invocations of timer_create and timer_settime and alert on CLOCK_TAI usage
Baseline expected timer syscall behavior per workload and flag anomalies
Correlate timer syscall activity with subsequent local privilege escalation or credential access attempts on the same host

Monitoring Recommendations

Forward audit(4) logs to a centralized platform for retention and correlation across the fleet
Monitor for unpatched kernel versions across FreeBSD systems using configuration management inventory
Track processes running as unprivileged users that make heavy use of POSIX timer interfaces

How to Mitigate CVE-2026-58084

Immediate Actions Required

Apply the kernel update published in FreeBSD-SA-26:51.ktimer to all affected hosts
Reboot affected systems after patching so the corrected kernel takes effect
Inventory FreeBSD systems and prioritize multi-user hosts, shared build servers, and jails accessible to lower-trust workloads

Patch Information

FreeBSD has published a security advisory and corresponding kernel patch. Consult the FreeBSD Security Advisory FreeBSD-SA-26:51.ktimer for the list of affected releases, patched versions, and the recommended upgrade procedure using freebsd-update or source-based rebuilds.

Workarounds

Configure a valid TAI offset system-wide so realtimer_gettime() succeeds for CLOCK_TAI, reducing the window in which the uninitialized buffer is returned
Restrict local shell access on multi-tenant FreeBSD hosts until patching is complete
Limit the ability of untrusted users to execute arbitrary binaries via jail configuration and mandatory access control policies such as mac_bsdextended(4)

bash

# Apply the FreeBSD security update and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now