FreeBSD CVE-2026-58084

Exploitation requires a valid low-privileged local user account on a FreeBSD 15.0-RELEASE (prior to p12) or 15.1-RELEASE (prior to p2) system where no UTC-TAI offset has been configured in the running kernel - this is the specific triggering condition identified in the description, as it causes realtimer_gettime() to return an error rather than populate the buffer. The attacker must be permitted to call timer_create(2) with CLOCK_TAI and timer_settime(2), which are available to unprivileged users by default on standard FreeBSD configurations. CVSS PR:L confirms authenticated low-privilege access is required; PR:N (unauthenticated) exploitation is not possible. Key limiting factors: requires local shell access (network-remote exploitation is ruled out by AV:L), affects only FreeBSD 15.x series (not earlier branches per available data), and the TAI offset absence is a common but not universal system state.

The NVD-assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) is internally consistent with the described exploitation path: a low-privileged local account is sufficient, no user interaction is required, and only confidentiality is impacted. The EPSS score of 0.18% (8th percentile) indicates low near-term exploitation probability by automated threat actors, which aligns with the local-access requirement limiting the pool of viable attackers. No CISA KEV listing exists and no public PoC has been referenced in available intelligence sources, both signals that exploitation remains opportunistic rather than widespread. The real-world risk is bounded by the requirement for an interactive shell account - remote unauthenticated exploitation is not possible. That said, kernel stack leaks carry secondary risk: leaked data can contain KASLR slide values, pointer residuals, or cryptographic material that facilitate privilege escalation chains. The narrow affected version scope (FreeBSD 15.x only) and the triggering precondition (absence of TAI offset configuration) further constrain the realistic exposure population. Organizations running FreeBSD 15.x in multi-tenant or shared-hosting environments should treat this as moderate-priority patching.

A low-privileged user with an interactive shell on an unpatched FreeBSD 15.x system writes a minimal C program that calls timer_create(CLOCK_TAI, ...) followed by timer_settime(2) with a target itimerspec. On a system without a configured TAI offset, the kernel silently fails to populate the old-timer buffer and copies raw stack contents back to the caller's struct itimerspec. The attacker reads the returned bytes, which may contain residual kernel pointer values, enabling KASLR bypass for a subsequent privilege escalation attempt. No public PoC has been identified at time of analysis.