NetBSD 11.0 Released with Known Open Security Issues
Original: NetBSD 11.0
Why This Matters
NetBSD 11.0 sets a precedent for transparent disclosure of open security issues at release time in open source OS projects.
The NetBSD Project announced NetBSD 11.0 on August 1, 2026. The release was significantly delayed due to third-party component stabilization and an increased volume of security reports attributed to AI-based vulnerability discovery tools. Three open security issues remain at release time.
The NetBSD Project officially released NetBSD 11.0 on August 1, 2026, following a notable delay caused by waiting for third-party components to reach stable releases and by a surge in reported security vulnerabilities. The project attributed this surge in part to the growing use of AI tools for vulnerability discovery.
Rather than delay the release further, the team chose transparency: three open security-related issues are acknowledged at launch. These include a missing local user privilege check in hdaudio(4) (PR 60492), a remotely triggerable null pointer dereference in ipfilter (PR 60484), and a use-after-free in pf's fragment reassembly (PR 60485). The project notes that both ipfilter and pf are not included in any released kernel by default, limiting exposure.
All open pullup requests will be committed to the stable branch shortly after the 11.0 release. The team is targeting a NetBSD 11.1 release within the next two months. The release process has been streamlined and automated where possible, though manual steps such as security officer signing of release hashes and file transfers across multiple architectures continue to constrain overall release speed.
Installation images are available via CDN, with ARM-specific images pre-configured with U-Boot available on the bootable ARM images page.