NetBSD 11.0 Release Notes

NetBSD 11.0 Overview

NetBSD 11.0 is now available, marking a significant update to the portable operating system. Key highlights of this release include the first official RISC-V port and the introduction of a MICROVM kernel for x86 architectures capable of booting in approximately 10 milliseconds.

Key Technical Improvements

Networking and Security

NetBSD 11.0 includes enhancements to the npf(7) firewall, specifically introducing layer 2 filtering and user/group filtering capabilities.

Hardware Support and Portability

NetBSD continues its commitment to extreme portability, providing improved support for a wide array of vintage and miscellaneous hardware, including:

  • Alpha
  • EVB
  • PPC
  • HP300
  • HPPA
  • M68K
  • Mac68K
  • MacPPC
  • MIPS
  • X68K

Community members highlight that NetBSD remains a primary choice for vintage hardware, supporting architectures such as the VAX 780 (1979) using the same codebase as modern x86 or ARM platforms.

Security Transparency and Open Issues

NetBSD 11.0 has been released with several known security issues. The project has opted for transparency over further delaying the release, citing an increase in security vulnerabilities discovered via AI tools and delays in third-party component stability.

Known Security Vulnerabilities

  • hdaudio(4): A missing local user privilege check in ioctl commands (PR 60492). A manual workaround is to remove /dev/hdaudio*, which preserves audio functionality.
  • ipfilter: A remotely triggerable null pointer dereference (PR 60484). This is mitigated by the fact that ipfilter is not included in released kernels by default.
  • pf: A use-after-free vulnerability in fragment reassembly (PR 60485). This is mitigated by the fact that pf is deprecated and not included in released kernels by default.

These issues are scheduled to be resolved in the upcoming 11.1 release, which is targeted for deployment within two months of the 11.0 launch.

Installation and Deployment

Media Options

Installation images are provided in multiple formats to accommodate different hardware:

  • CD-ROM: ISO images split into <700MB segments.
  • DVD: Full-sized -dvd.iso images.
  • USB/Flash Media: .img files (must be decompressed using gunzip or 7-Zip before writing).

Architecture-Specific Notes

  • ARM Devices: Users should obtain pre-configured images with U-Boot from the bootable ARM images page.
  • Upgrading: Users utilizing cgd(4) can use sysupgrade(8) from pkgsrc for a streamlined upgrade process.

Community Perspectives

Users and contributors emphasize NetBSD's role as a specialized tool for diverse hardware environments. One user noted the OS's utility in building heterogeneous clusters using outdated CPUs, including SGI Indys and PowerMac G3s, stating:

"NetBSD is the only thing that made that possible."

Other contributors praise the system's clean design and comprehensive documentation, describing it as a "desert island OS" due to its ability to be used for novel tasks without requiring external internet assistance.

Sources