CVE-2026-58084: To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the…
CVE-2026-58084 · Severity: medium · CVSS 5.5 · Published 2026-08-19
To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace.
An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCK_TAI and calling timer_settime(2), potentially disclosing sensitive kernel data.
No. Junglewise Threat Intelligence has no report of CVE-2026-58084 being exploited in the wild.
How severe is CVE-2026-58084?
Medium severity, with a CVSS score of 5.5, published 19 August 2026.
Which products and versions are affected?
Freebsd. The advisory does not name versions.
Is there a fix for CVE-2026-58084?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-58084?
Check whether you run Freebsd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.