CVE-2026-58084: Kernel stack disclosure via timer_settime(2)
To retrieve the previous timer value, the kernel calls realtimergettime(), which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace.
An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCKTAI and calling timersettime(2), potentially disclosing sensitive kernel data.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems where an unprivileged local user can create POSIX timers and invoke timer_settime(2) are exposed when CLOCK_TAI has no configured TAI offset. The issue is a local information disclosure, not a remote attack path.
What does an attacker need to do to trigger the disclosure?
The attacker needs local unprivileged code execution. They can create a POSIX timer using CLOCK_TAI and call timer_settime(2), causing uninitialized kernel stack output to be copied to userspace when obtaining the prior timer value fails.
Does the issue depend on a specific clock configuration?
Yes. The described failure occurs for CLOCK_TAI when no TAI offset has been configured. In that condition, retrieving the timer's current time can fail and the unchecked error path may disclose the uninitialized output buffer.