FreeBSD 15.1-RELEASE Release Notes

Introduction

This document contains the release notes for FreeBSD 15.1-RELEASE. It describes recently added, changed, or deleted features of FreeBSD. It also provides some notes on upgrading from previous versions of FreeBSD.

The "release" distribution to which these release notes apply represents the latest point along the 15-STABLE development branch since 15-STABLE was created. Information regarding pre-built, binary "release" distributions along this branch can be found at https://www.FreeBSD.org/releases/.

The "release" distribution to which these release notes apply represents a point along the 15-STABLE development branch between 15.0-RELEASE and the future 15.2-RELEASE. Information regarding pre-built, binary "release" distributions along this branch can be found at https://www.FreeBSD.org/releases/.

This distribution of FreeBSD 15.1-RELEASE is a "release" distribution. It can be found at https://www.FreeBSD.org/releases/ or any of its mirrors. More information on obtaining this (or other) "release" distributions of FreeBSD can be found in the Obtaining FreeBSD appendix to the FreeBSD Handbook.

All users are encouraged to consult the release errata before installing FreeBSD. The errata document is updated with "late-breaking" information discovered late in the release cycle or after the release. Typically, it contains information on known bugs, security advisories, and corrections to documentation. An up-to-date copy of the errata for FreeBSD 15.1-RELEASE can be found on the FreeBSD Web site.

This document describes the most user-visible new or changed features in FreeBSD since 15.0-RELEASE. In general, changes described here are unique to the 15-STABLE branch unless specifically marked as MERGED features.

Typical release note items document recent security advisories issued after 15.0-RELEASE, new drivers or hardware support, new commands or options, major bug fixes, or contributed software upgrades. They may also list changes to major ports/packages or release engineering practices. Clearly the release notes cannot list every single change made to FreeBSD between releases; this document focuses primarily on security advisories, user-visible changes, and major architectural improvements.

Upgrading from Previous Releases of FreeBSD

Binary upgrades between RELEASE versions (and snapshots of the various security branches) are supported using the freebsd-update(8) utility. See the release-specific upgrade procedure, FreeBSD 15.1-RELEASE upgrade information, with more details in the FreeBSD handbook binary upgrade procedure. This will update unmodified userland utilities, as well as unmodified GENERIC kernels distributed as a part of an official FreeBSD release. The freebsd-update(8) utility requires that the host being upgraded have Internet connectivity.

Source-based upgrades (those based on recompiling the FreeBSD base system from source code) from previous versions are supported, according to the instructions in /usr/src/UPDATING.

Upgrading FreeBSD should only be attempted after backing up all data and configuration files.

Security and Errata

This section lists the various Security Advisories and Errata Notices since 15.0-RELEASE.

Security Advisories

Advisory Date Topic

FreeBSD-SA-25:09.netinet

22 October 2025

SO_REUSEPORT_LB breaks connect(2) for UDP sockets

FreeBSD-SA-25:10.unbound

26 November 2025

Cache poison in local-unbound service

FreeBSD-SA-25:12.rtsold

16 December 2025

Remote code execution via ND6 Router Advertisements

FreeBSD-SA-26:01.openssl

27 January 2026

Multiple vulnerabilities in OpenSSL

FreeBSD-SA-26:03.blocklistd

10 February 2026

blocklistd(8) socket leak

FreeBSD-SA-26:05.route

24 February 2026

Local DoS and possible privilege escalation via routing sockets

FreeBSD-SA-26:06.tcp

26 March 2026

TCP: remotely exploitable DoS vector (mbuf leak)

FreeBSD-SA-26:07.nvmf

26 March 2026

Remote denial of service via null pointer dereference

FreeBSD-SA-26:08.rpcsec_gss

26 March 2026

Remote code execution via RPCSEC_GSS packet validation

FreeBSD-SA-26:09.pf

25 March 2026

pf silently ignores certain rules

FreeBSD-SA-26:10.tty

21 April 2026

Kernel use-after-free bug in the TIOCNOTTY handler

FreeBSD-SA-26:11.amd64

21 April 2026

Missing large page handling in pmap_pkru_update_range()

FreeBSD-SA-26:12.dhclient

29 April 2026

Remote code execution via malicious DHCP options

FreeBSD-SA-26:13.exec

29 April 2026

Local privilege escalation via execve()

FreeBSD-SA-26:14.pf

29 April 2026

pf can overflow the stack parsing crafted SCTP packets

FreeBSD-SA-26:15.dhclient

29 April 2026

Remotely triggerable out-of-bounds heap write in dhclient

FreeBSD-SA-26:16.libnv

29 April 2026

Stack overflow via select() file descriptor set overflow

FreeBSD-SA-26:17.libnv

29 April 2026

Heap overflow in libnv

Errata Notices

Errata Date Topic

FreeBSD-EN-25:19.zfs

16 December 2025

Unprivileged kernel NULL pointer dereference

FreeBSD-EN-25:20.vmm

16 December 2025

bhyve(8) PCI passthru regression

FreeBSD-EN-26:01.devinfo

27 January 2026

devinfo output formatting regression

FreeBSD-EN-26:02.arm64

27 January 2026

arm64 SVE signal context misalignment

FreeBSD-EN-26:03.vm

27 January 2026

The page fault handler fails to zero memory

FreeBSD-EN-26:04.arm64

10 February 2026

Kernel panic when dumping process core on arm64

FreeBSD-EN-26:05.vm

21 April 2026

The page fault handler fails to zero memory

FreeBSD-EN-26:06.timerfd

21 April 2026

Periodic timerfd(2) timers may produce incorrect results

FreeBSD-EN-26:07.pkgbase

21 April 2026

Base packages fail to build with newer versions of libucl

FreeBSD-EN-26:08.pf

29 April 2026

Incorrect duplicate rule detection for automatic tables

FreeBSD-EN-26:09.tzdata

29 April 2026

Timezone database information update

FreeBSD-EN-26:10.amd64

29 April 2026

TLB invalidation bug on AMD systems with INVLPGB

FreeBSD-EN-26:11.dhclient

1 May 2026

dhclient(8) lease validation is too strict

Userland

This section covers changes and additions to userland applications, contributed software, and system utilities.

Userland Configuration Changes

The us.intl.acc.kbd keyboard layout has been installed and available for use with the vt(4) console. 34196ce83f9c.

The Lenovo laptop keyboard keymap has been installed and available for use with vt(4). 23eaa98d6dc1.

The default shell for the root user and the 'freebsd' user in release images is changed from csh(1) to sh(1). c8763bd078d8.

rc.subr now supports setting the audit user for services via rc.conf directives, allowing administrators to override the audit user ID when services are started, which prevents unexpected audit log attribution in scenarios like unprivileged users restarting services via sudo. 7edef9117688. (Sponsored by Modirum MDPay; Klara, Inc.)

Userland Application Changes

The find(1) utility now supports -xattr and -xattrname primaries for searching files based on extended attributes. The -xattr primary matches files that have any extended attribute, while -xattrname allows filtering by a specific attribute name, optionally prefixed with a namespace like "user:" or "system:". 5cbb1e05086c. (Sponsored by Klara, Inc.)

The newfs(8) utility now prevents simultaneous use of GEOM journaling and soft updates. When GEOM journaling is requested, soft updates are not enabled automatically, and explicit requests for both features result in an error. f758262e66dd.

The tr(1) utility now correctly handles the CCLASS ([:alpha:]) character class in Unicode mode, fixing case conversion operations for alphabetic characters. a51ec1cc5a82.

The diff3(1) utility’s merge mode is made compatible with GNU diff3, improving interoperability with other systems and tools. a6f17dd2430b.

The pwd(1) utility now defaults to the -L (logical) option, following POSIX semantics. Paths containing dot or dot-dot components are rejected in logical mode. 24b95c5ece3d.

A -E flag has been added to bectl(8) to create an empty boot environment without cloning the currently running environment. This allows users to create a new, independent boot environment for manual installation or configuration. 2b5087e9850b.

The daemon(8) utility now supports specifying the output file mode via a new option, allowing non-root log collectors to access log files and improving compatibility with log rotation tools. 4bc40d5a624e.

The newfs(8) utility gains a -u flag to disable soft updates and soft updates journaling, providing a way to turn off the default soft updates for UFS2 filesystems. f5a51cfba15c. (Sponsored by Klara, Inc.; NetApp, Inc.)

The zfs(8) clone command now accepts the -u option to prevent automatic mounting of newly created datasets. This allows users to create clones without immediately mounting them, which can be useful for scripting or when preparing datasets for later use. 6ab8f46c6c47.

The zdb(8) utility gains a -O option for use with -r to specify an object ID directly, allowing copying of a file by object ID rather than pathname. ccb7c82aa15b.

setaudit(8) utility has been added for managing audit policies. dc88f0003e85. (Sponsored by Modirum MDPay; Klara, Inc.)

The ipfs(8) utility has been disabled by default and its kernel support is now optional. Users who rely on ipfs must explicitly enable it in the kernel configuration. 91de9b501aa7.

The sockstat(1) utility now displays UDP-Lite endpoints by default. c10317b0c455.

The dtrace(1) utility now supports the ustackdepth variable on arm64, allowing users to query user-space stack depth in DTrace scripts on that architecture. 00412df3265e.

DTrace kernel diagnostic messages now use a more intuitive prefix dtrace, improving log search consistency. 7781f5e09ffc.

bsdinstall script now performs pkgbase installation by default, with components specified via COMPONENTS variable, while legacy distset installation remains available if DISTRIBUTIONS is defined. cb7880bb0900. (Sponsored by ConnectWise)

cron(8) now implements full PAM session lifecycle for user jobs, allowing PAM modules to establish credentials and sessions before job execution. PAM environment variables are exported to job processes with user crontab variables taking precedence. A default pam_permit.so session rule is added to /etc/pam.d/cron to enable session support without changing default behavior. 770479c4cea0.

Contributed Software

Certificate authority bundle has been regenerated from NSS 3.123.1, adding new trusted certificates (OISTE Server Root ECC G1, OISTE Server Root RSA G1, SwissSign RSA TLS Root CA 2022, TrustAsia TLS ECC Root CA, TrustAsia TLS RSA Root CA, Certigna Root CA, e-Szigno TLS Root CA 2023, Atos TrustedRoot Root CA ECC G2 2020, Atos TrustedRoot Root CA RSA G2 2020) and removing several certificates. Several previously trusted CAs have been moved to untrusted status, and a number of new untrusted certificates have been added. 5bb9cd154dfa.

Time zone code has been updated to 2026b. b72580fcb0a7.

tzdata has been updated to 2026b. 1e5aff8e5bc6.

Mediatek’s mt76 driver has been updated to version based on Linux kernel tag v7.0. 808910385ce9. (Sponsored by The FreeBSD Foundation)

OpenSSL has been updated to version 3.5.6. e2fcde7333a5.

libfido2 has been updated to 1.16.0. a54428834b9d. (Sponsored by The FreeBSD Foundation)

expat has been updated to version 2.7.5. 0b94911946e9.

xz(1) has been updated to version 5.8.3. 7176f76d2251.

libcbor has been updated to 0.13.0. 967186fe0a54. (Sponsored by The FreeBSD Foundation)

tcpdump(1) has been updated to version 4.99.6. 6af32a9d37ad. (Sponsored by The FreeBSD Foundation)

libpcap has been updated to version 1.10.6. e0ae00f43186. (Sponsored by The FreeBSD Foundation)

zlib(3) has been updated updated to version 1.3.2. 74f357256769.

OpenZFS has been updated to version 2.4.2. 409247a6cbd1.

USB vendor database has been updated to 2025.12.13. 9b2cba4a8a69.

The PCI vendor database has been updated to the 2026-02-10 version, providing current hardware identification for tools like pciconf(8). 2483216eecf3.

blocklistd(8) has been updated to version 2026-02-07. d73fac00cdd4.

Spleen font has been updated to version 2.2.0. The update adds several previously missing characters critical for manual pages on high-dpi displays, including em-dash, en-dash, hyphen, angle brackets, white square, dagger, and double dagger. It also improves character alignment across different font sizes. da4c7b4518dd.

GoogleTest has been updated to version 1.17.0. The new version now requires C++17 to build. 0029027156f4.

ncurses(3) has been updated to version 6.6. The update is ABI compatible with version 6.5. HTML documentation is removed. 297d5bf89067.

nvi(1) has been updated to version 2.2.2. b840145f1985.

mtree(8) has been updated to snapshot 20260111 from NetBSD. e2e7269461e9.

Unicode support has been updated to Unicode 17.0.0 and CLDR 48, adding 4,803 characters and 4 new scripts (Sidetic, Tolong Siki, Beria Erfe, Tai Yo). This affects locale definitions, collation, monetary, and numeric formatting for UTF-8 locales. 476a063a88aa.

bmake(1) has been updated to version 20251111. 11aa32794394.

sqlite3(1) has been updated to version 3.50.4. e37206a66db0.

unbound(8) has been updated to version 1.24.1. fc3c317b055c.

The blacklist subsystem has been renamed to blocklist (blocklistd(8)) throughout the system. Old names in rc scripts, firewall rules, and configuration knobs remain functional but emit warnings. This change follows upstream terminology updates. 7f6f2139eef9.

bsddialog(1) has been updated to version 1.0.5. aa2fe36f5e4b. (Sponsored by The FreeBSD Foundation)

less(1) has been updated to version 692. 109324d5e7ab.

zstd has been updated to version 1.5.7. 1aa2b46a0707.

MIT krb5 has been updated to 1.22.2. 3de8ca652d93.

Heimdal (Kerberos) has been updated to version 1.22.2. 3ee9a0f8924d.

Deprecated Applications

The lpr suite of printing utilities (lpr(1), lpd(8), lpc(8), lpq(1), lprm(1), lp(1), pac(8), lptest(1), chkprintcap(8)) has been deprecated and may be removed before FreeBSD 16.0. Users are advised to use alternatives such as print/cups or sysutils/LPRng from the ports collection. 9b75d6ec6929.

The bsdlabel(8) utility has been scheduled for removal in FreeBSD 16.0. Users should migrate to gpart(8) for disk labeling. be24d85ec784. (Sponsored by The FreeBSD Foundation)

The fdisk(8) utility has been scheduled for removal in FreeBSD 16.0. Users should transition to gpart(8) or bsdinstall(8) for disk partitioning. 2be4c64a0d27. (Sponsored by The FreeBSD Foundation)

Runtime Libraries and API

The posix_spawn(3) interface now supports the POSIX-required chdir and fchdir file actions, enabling processes to change their working directory during spawning. 43347b26fb46.

The posix_spawnattr_getexecfd_np(3) and posix_spawnattr_setexecfd_np(3) functions have been added, allowing a file descriptor to be used as the executable file for posix_spawn. 6b9e7e922d8b.

The pthread_tryjoin_np(3) function has been added, which allows a thread to attempt to join another thread without blocking. a8891c29d6a0.

The libc string functions memcpy(3), memmove(3), and memset(3) on AArch64 now use the MOPS (Memory Operations) hardware instructions when available, improving performance for these common operations. d8e700f2eeb9. (Sponsored by Arm Ltd)

Adds a glibc-compatible tdestroy(3) function to libc, providing a standardized way to destroy binary search trees and improving compatibility with software expecting this function. 6197518ee905.

Adds strdupa(3) and strndupa(3) functions, which allocate memory for a copy of a string on the stack using alloca(3). This provides a convenient alternative to strdup(3) and strndup(3) for temporary string copies that are automatically freed when the function returns. b2e649a0b98d.

Adds C23 <stdbit.h> header with bit manipulation functions like stdc_bit_ceil(), stdc_bit_width(), and stdc_count_ones(). This provides standard bit operations for C programs. 275c11b7ccff.

The C23 trigonometric functions from the *pi family (acospi, acospif etc.) have beed exposed in <math.h>. This provides standard-conforming APIs for applications using these functions. 104488641aca.

The C23 memalignment() function has been added to libc, allowing programs to compute pointer alignment. A man page has been included. 24ea81047de7.

The SONAME of libzfs and libzpool have been bumped to libzfs7 and libzpool7 due to ABI-breaking changes, requiring recompilation of dependent applications. 5b2489caf266.

Adds libuvmem, a userland port of the vmem(9) kernel memory allocator, providing a similar interface for userland applications. 3ae14e8f332f.

Cloud Support

This section covers changes in support for cloud environments.

Oracle Cloud Infrastructure (OCI) build targets and related scripts are removed. The last official OCI images are from FreeBSD 15.0-RELEASE. 2702a3ac1ab6. (Sponsored by SkunkWerks, GmbH)

The pkg(7) package is now installed on VM and cloud images that use a packaged base system, enabling base system updates without requiring manual installation of pkg from the ports repository. c8d759230a0e. (Sponsored by Amazon)

The GCE image family now includes TARGET and FS in its name, ensuring that image families are unique per architecture and filesystem. This prevents the GCE instances API from selecting an incompatible image when using an image family name. 0005bb76e2e7.

I/O interrupts from the ena(4) device on Graviton (arm64) systems are now spread between CPUs rather than all landing on CPU 0; this results in significantly higher network performance on those EC2 instance types. b2ba4131b9b0. (Sponsored by Amazon)

Cloud image configurations for cloud-init and ec2-small now use firstboot_pkg_upgrade for package updates. 73ec43ab702f.

A firstboot package auto updater has been introduced for cloud images. On first boot, the base system packages are automatically updated to patch the system. 10c4498f93d2. (Sponsored by Google Cloud)

Kernel

This section covers changes to kernel configurations, system tuning, and system control parameters that are not otherwise categorized.

General Kernel Changes

The System Dynamic Tracing (SDT) provider is now enabled on 32-bit powerpc and powerpc64le platforms, allowing users to utilize DTrace probes on these architectures. 769bc6877399.

Adds a scheduler selection framework that allows choosing different CPU schedulers at boot time via a tunable. This provides a foundation for future scheduler implementations. 159a66aecc9c.

The sched_ule scheduler is now implemented as a scheduler instance, which may affect system performance and scheduling behavior for users. ec10524db95a.

The kernel configuration for GENERIC on amd64 has been includes both SCHED_ULE and SCHED_4BSD schedulers, allowing users to choose between them at boot via the kern.sched sysctl. a3b5daf4242f.

The MINIMAL kernel configuration has included the virtio_scsi driver, enabling booting in qemu/kvm virtual machines. 80dec91da334. (Sponsored by Klara, Inc.; NetApp, Inc.)

The pdwait(2) system call has been added for waiting on process descriptors, providing an alternative to wait4(2) for processes created with pdfork(2). 758de6465572.

The pdrfork(2) system call has been added, providing a new mechanism for process creation with deterministic resource inheritance. 4ae6f372e26c.

A race condition in the powerpc thread switching code that could cause system hangs during boot on multi-CPU power9 pseries guests has been resolved. a50789d8b89b.

The sysctls hw.ata.rotating and hw.ata.unmapped_io have been scheduled for removal in FreeBSD 16 instead of FreeBSD 15. 469ab88d107c. (Sponsored by The FreeBSD Foundation)

The sysctl vfs.zfs.min_auto_ashift and other legacy ZFS sysctls now emit warnings when used, indicating they are deprecated and will be removed. Users should update scripts and configurations to use the new sysctl names, such as vfs.zfs.vdev.min_auto_ashift. f0033878b92e. (Sponsored by The FreeBSD Foundation)

The Linux compatibility layer adds support for the F_DUPFD_QUERY fcntl command, which is used with kcmp(2) KCMP_FILE for checking file descriptor equivalence in Linux containers. ec8d0b5f5dfb.

Devices and Drivers

This section covers changes and additions to devices and device drivers since 15.0-RELEASE.

Device Drivers

ena(4) driver updated to v2.8.3. This includes a bug fix to the receive path for jumbograms which can yield a 10x or higher improvement in network throughput. b949f8292de5. (Sponsored by Amazon, Inc.)

The bcm2838_xhci driver now correctly identifies the Raspberry Pi 400 hardware by its compatible string, enabling proper xhci initialization and USB functionality (including external ports and the built-in keyboard) on that platform. 861deac98c4c.

A driver for the bcm2835-virtgpio GPIO controller found on Raspberry Pi 3B and some Compute Module boards has been added. This enables control of the ACT (green) LED via gpioled(4). fb10574334ca.

smartpqi driver has been updated to vendor version 14.4690.0.2008 - 15.2.0.2008. The update adds support for new controllers and increases the I/O buffer size limit for passthrough ioctl from 16-bit to 32-bit. 0c370a416b68. (Sponsored by Microchip Technology Inc.)

The asmc(4) driver no longer supports 32-bit Intel-based Macs, making it clear that use on i386 hardware is not supported. e16f1bf3baa1.

The mfi(4) driver now supports the Fujitsu RAID Controller SAS 6Gbit/s 1GB (D3116) used in Fujitsu PRIMERGY servers. e16e4cd25c1d.

ath(4) driver code updated to Linux kernel version 6.17, improving Atheros/QCA wireless hardware support. 1fa2a48dab66.

The hardware performance monitoring counter (hwpmc) support has been added for additional Intel CPU models: Alder Lake (models 6-B7, 6-BA, 6-BF), Alder Lake-N, and Emerald Rapids. Users running on these processors can now collect performance events using pmc(3) and related tools. The Emerald Rapids support includes JSON event definitions imported from Intel perfmon version 1.06, providing comprehensive event coverage. a40167734ecb, 6b0cb6ea249e, 9ac702781508. (Sponsored by Stormshield)

The hid(4) driver now allows members of the 'game' group to access game controller events, enabling unprivileged use of controllers via libraries like libsdl. d0e1b3edee70.

The iwx(4) driver has been included in the kernel build configuration, enabling support for Intel AX210/AX211/AX411 Wi-Fi 6E and Wi-Fi 7 wireless network adapters. 0f9ab6c5232b.

The NVMe driver now supports BAR5 for Table BIR and PBA BIR, enabling FreeBSD to work on Google Compute Engine C4 machines with NVMe controllers that use separate 32-bit BAR4 and BAR5 registers. 6c321dc15d52. (Sponsored by Google)

The ice(4) driver now supports the Intel E835-XXV-4 network adapter. b59a9230a6a8. (Sponsored by Intel Corporation)

The ice(4) driver now supports Intel E835 Ethernet adapters with SPDM security and RDMA capabilities on 100Gbps and 200Gbps links. 16004d2a9eee. (Sponsored by Intel Corporation)

The qat(4) driver now supports the 402xx device (IDs 0x4944/0x4945) using the existing qat_4xxx driver. Device-specific firmware files has been added. 88c0ce38bc18. (Sponsored by Intel Corporation)

Deprecated and Removed Drivers

The hifn(4) driver has been marked as scheduled for removal in FreeBSD 16.0, alerting users to plan for future compatibility changes. ba6c676ef3ac.

The safe(4) driver has been marked for removal in FreeBSD 16.0, indicating deprecation and future removal of the driver. 0ef2ecd0ced4.

The agp(4) driver deprecation notice has been updated to indicate removal in FreeBSD 16.0 instead of 15.0. 92f169fe0f19. (Sponsored by The FreeBSD Foundation)

The fdc(4) driver and floppy utilities (fdcontrol(8), fdformat(8), fdread(1), fdwrite(1)) have been deprecated. Support is planned for removal in FreeBSD 16. 661b40ffdee2. (Sponsored by The FreeBSD Foundation)

The deprecation notice for the le(4) driver has been updated to reflect that it was not removed prior to FreeBSD 15.0, indicating ongoing support status. 59ba7278499f. (Sponsored by The FreeBSD Foundation)

Storage

This section covers changes and additions to file systems and other storage subsystems, both local and networked.

General Storage

The mt(1) utility and libmt library add support for LTO-10 and LTO-10P tape density codes and specifications. LTO-10 tape drives are not backward compatible with previous generation LTO tapes. 7fe98ee4d49a. (Sponsored by Spectra Logic)

ZFS

The minimum scrub and resilver times for ZFS have been reduced from multi-second to sub-second values, allowing faster transaction group cycles on modern storage and improving write performance under heavy load. 35ee242abcba.

The commit introduces a new tunable, zfs_arc_evict_batches_limit, to improve parallel eviction performance in the ZFS ARC. This change reduces lock contention and can significantly increase throughput for certain workloads. 8a79d0968006.

The zpool(8) prefetch command now supports BRT (Block Reference Table) metadata, improving performance for block cloning operations and frees of cloned blocks. The -t parameter is now optional; when omitted, the command prefetches both DDT and BRT metadata. 41878d57eaf3.

NFS

The NFS client now properly handles case-insensitive file systems like msdosfs(4) when exported via NFS. Name caching has been modified to avoid false cache hits for different case variations of the same file name. 406c98d2ca1d.

NFSv4 diskless boot now supports configurations using nfsuserd(8) for name and id mappings. The kernel primes the mapping cache with essential entries to avoid deadlocks during boot. Users must set boot.nfsroot.options="nfsv4" and boot.nfsroot.user_domain="<user.domain>" in loader.conf. 692a289922d2.

Adds internal infrastructure for POSIX draft ACLs as an extension to NFSv4.2, based on an Internet Draft. These changes prepare the NFS client and server for future support but introduce no user-visible semantics changes at this time. Note that due to internal KAPI changes, nfscommon.ko, nfscl.ko, and nfsd.ko must be rebuilt from sources after updating. 20bfa56c514b, 2eddaeb3e505, d842c511d84c, dccf41dd1834, 144c1eda3973.

The NFSv4 client and server now support the archive attribute (UF_ARCHIVE), which is used by Windows NFSv4.1 clients despite being deprecated in RFC8881. This improves interoperability with Windows NFS clients. 3a64c667f16f.

The support for mounting a diskless root file system via NFSv4 has been added. Requires specific server configuration and client settings in loader.conf(5) and sysctl.conf(5). 2a97b49bc472.

iSCSI TargetName matching on login is now case-insensitive again, restoring RFC 3722 compliance. 379805b29732. (Sponsored by ConnectWise)

Boot Loader Changes

This section covers the boot loader, boot menu, and other boot-related changes.

Boot Loader Changes

A shutdown splash screen has been added to the splash(4) kernel feature. Users can customize the shutdown splash by providing a PNG image via the shutdown_splash directive in loader.conf(5). After a kernel panic, the splash screen is no drawn over the debugger output, making panic information visible when ddb(4) is disabled. 0bd9b26d19e2, 6a3966f363d3. (Sponsored by Defenso)

The EFI boot loader now uses firmware-provided Blt functions only when using GOP (Graphics Output Protocol), not UGA (Universal Graphics Adapter). This improves compatibility with older MacBook systems where UGA Blt functions were unreliable. d3902baca506.

Networking

This section describes changes that affect networking in FreeBSD.

General Network

Adds support for masked IP address lookups in ipfw(8) tables, allowing non-contiguous prefixes and enabling more CPU-efficient firewall configurations. a9b93531788c. (Sponsored by Yandex LLC)

The ipfw(8) firewall now supports masked IP address lookups in tables, allowing non-contiguous prefixes for more efficient firewall rule configurations. This enables CPU-effective firewall setups by masking non-significant bits in lookup keys and table entries. a9b93531788c. (Sponsored by Yandex LLC)

IPv6 packets are now passed to divert sockets, removing a previous limitation that restricted divert sockets to IPv4 only. This enables IPv6 packet handling in divert socket applications. e5cf3437275f. (Sponsored by OPNsense, Klara, Inc.)

Adds a sysctl/tunable net.inet.ipf.jail_allowed to control whether a jail can manage its own ipfilter rules, pools, and settings. The default denies jail access, requiring host system management of jail rules via interface attachment or enabling the sysctl for jail control. 65bc0a1ade72.

The ipfw(8) version 3 compatibility code for FreeBSD 8 and earlier has been removed, as it is obsolete and no longer needed. This cleanup may affect systems still using very old configurations, but it does not change the functionality for current supported releases. 9657c50cdd77. (Sponsored by The FreeBSD Foundation)

The support for RFC 7217 stable IPv6 address generation via a new ifconfig 'stableaddr' flag and associated sysctls has been added. The feature is disabled by default, preserving existing behavior. The ifconfig(8) manual page is updated with documentation. 865e0b20ca3c.

Wireless Networking

The ath12k driver for Qualcomm Atheros wireless devices has been updated to version v7.0 from Linux, adding support for Wi-Fi 7 chipsets and restructuring the driver with a new wifi7 subdirectory. bbfa2e7345fe. (Sponsored by The FreeBSD Foundation)

The ath11k wireless driver has been updated to a newer version from Linux 7.0, which may improve performance and stability for supported hardware. 24c9bc6e364a. (Sponsored by The FreeBSD Foundation)

The ath10k driver for Atheros/QCA wireless chipsets has been updated to version 7.0, based on Linux tag v7.0. 4208012711cc. (Sponsored by The FreeBSD Foundation)

The rtw89(4) wireless driver has been updated to version v7.0, adding support for newer Realtek chipsets and improving stability and functionality. 7ffebcdb702d. (Sponsored by The FreeBSD Foundation)

The iwlwifi(4) wireless driver has been updated to version 7.0. This update includes changes to support for Intel wireless devices, new firmware API structures, and regulatory updates. f45e34316eb7. (Sponsored by The FreeBSD Foundation)

The rtw88(4) driver has been updated to version 7.0, based on the Linux kernel tag v7.0, incorporating various fixes and improvements for Realtek wireless devices. bcdf750def1d. (Sponsored by The FreeBSD Foundation)

Adds initial support for LinuxKPI-based wireless drivers, notably iwlwifi(4), on RISC-V systems. While ACPI is not yet fully supported on this architecture, the driver framework has been adapted to allow compilation and operation where possible. Note that the rtw89(4) driver is temporarily unavailable on RISC-V due to unresolved ACPI dependencies. 7990fa2a819c, 24777428cbc2, d301aadc994f, 4a56313c73eb. (Sponsored by The FreeBSD Foundation)

Hardware Support

This section covers general hardware support for physical machines, hypervisors, and virtualization environments, as well as hardware changes and updates that do not otherwise fit in other sections of this document.

Please see the list of hardware supported by 15.1-RELEASE, as well as the platforms page for the complete list of supported CPU architectures.

Virtualization Support

Adds a new jail configuration knob allow.vmm_ppt to control PCI passthrough access in bhyve(8) jails. The change requires explicit configuration for PCI passthrough functionality in jails, replacing the previous blanket restriction. 94066f9a07ad. (Sponsored by The FreeBSD Foundation; Klara, Inc.)

The virtio GPU driver now works with Parallels Desktop by splitting resource attachment requests, enabling graphics support in this virtualization environment. 91ce7a19120a. (Sponsored by Arm Ltd)

The support for the Fine-Grained Trap (FGT) registers on arm64 has been added, enabling enhanced virtualization capabilities for hypervisors. 89776ce6a7b7. (Sponsored by Arm Ltd)

The commit enables the Memory Operations (MOPS) instruction set for arm64 userspace when the hardware feature is present. This allows user applications to use MOPS instructions for improved memory operations performance. 2a9a92ba7bd7. (Sponsored by Arm Ltd)

UNIX domain socket support added to bhyve(8) remote framebuffer. Graphical console now available for bhyve instances in jails without networking. d29dd64b3f88. (Sponsored by Defenso)

The amd64 architecture now supports LASS (Linear Address Space Separation), a security feature that helps isolate kernel and user address spaces. This change may affect debugging and low-level system programming. 532c8d3f90b9.

The amd64 architecture now supports the Extended Destination ID standard, enabling support for up to 32768 APIC IDs in IO-APIC and MSI without interrupt remapping; in particular, this adds support for EC2 "r8i.96xlarge" instances. b54646e37a2b. (Sponsored by Amazon)

Documentation

This section covers changes to manual (man(1)) pages and other documentation shipped with the base system.

Man Pages

The sh(1) manual page now includes detailed job control documentation, adopting POSIX standard text to match the FreeBSD implementation. 0b5ced487a28.

pdfork(2) and pdwait(2) manual pages has been added documenting the pdrfork and pdwait system calls. 780b7f9e0ece.

The renameat2(2) syscall is documented, providing users with information about the extended rename functionality. 3ccc39d38ed8.

The write(2) manual now includes a new section describing the atomicity guarantees of write operations. 514c8f173ce0.

The manual page for the undocumented mq_getfd_np(3) function from librt(3) has been added. This provides documentation for a function that has been present since FreeBSD 11. 992f994bb71e.

Adds posix_spawnattr_getprocdescp_np(3) and posix_spawnattr_setprocdescp_np(3) manual pages, documenting the extensions for managing process descriptors in posix_spawn. 4d8e4b67f5b5.

The man page for pthread_join(3) is updated to document the pthread_tryjoin_np(3) function, providing users with a non-blocking alternative for thread joining. d1ac644ccc43.

Manuals for several DTrace providers have been added, including dtrace_vfs(4) (VFS activity), dtrace_pid(4) (user-level process tracing),dtrace_priv(4) (privilege checks), and dtrace_callout_execute(4) (callout handler execution). 09af13403983, 20fc2b332bd2, 443b7c41d619, 1c0178baa7c3.

Adds geom_zero(4) manual page documenting the GEOM ZERO class and its features. 32ef68b0f30d.

Documentation for two new sysctls, tx_reclaim_ticks and tx_reclaim_thresh (iflib(4)), has been added. These sysctls affect network driver transmit behavior. ef8c912aadad. (Sponsored by Netflix)

The nfsv4(4) manual page now includes documentation for setting up an NFSv4 root file system, providing guidance for users who wish to use this feature. 6ef2df5e8e7a.

A new man page for nlsysevent(4) has been added to the base system. 56a5d11dd69f.

Adds vmgenc(4) manual page documenting the VM Generation ID Counter driver, which reseeds the kernel entropy pool when virtual machine cloning or snapshot restoration is detected. 252f0c28855b.

The vt(4) manual now includes an example on increasing scrollback size and a section explaining console fonts, covering conversion, support, and usage. 2da71ee296ad.

The pf.conf(5) manual page now includes nat-to and rdr-to in the BNF grammar, clarifying the syntax for users. 1c7c2027f2d1. (Sponsored by Rubicon Communications, LLC ("Netgate"))

The resolver(5) man page now documents the edns0, inet6, insecure1, insecure2, no-check-names, and rotate options, which are parsed by res_init(3) but were previously undocumented. c988f316d6c6.

The documentation has been added for several string functions to d(7): strchr, strjoin, strrchr, strstr, strtok, strlen, and substr. d086bf34b56f.

The ports(7) manual page has been substantially improved. The FILES section has been expanded and refactored into three tables for better clarity, with terse descriptions of individual port files now included. Additionally, the DEFAULT_VERSIONS variable is now documented, providing users with information about setting default versions for ports options. 1b5b7867b67f, 782ea981ea72, 0ebf602e1785.

The tuning(7) manual page now documents kernel scheduler tunables, providing users with information on available scheduler configuration options. 4e5c15f3107e.

The manual pages have been added for the deprecated blacklist utilities (blacklistctl(8), blacklistd(8), blacklistd.conf(5), libblacklist(3)), documenting their deprecation and nuances. This provides users with updated documentation for the deprecated blacklist tools, which are now renamed to blocklist. f935c0f66f75.

The man page for cron(8) is updated to clarify the system crontab format. d2fb6b8f80cc.

The ifconfig(8) manual page formatting has been corrected to improve readability. c20f5fd44322.

The jail(8) manual page now documents two methods for jail creation: from a package base and from a distribution set. f467eb078f51, 5d7cd576d99b.

The shutdown(8) manual page now documents additional time formats accepted by the shutdown command, improving clarity for users. c13157b87b00.

Adds deadfs(9) manual page documenting the dead file system. d8097cf79cfa.

Ports Collection and Package Infrastructure

This section covers changes to the FreeBSD Ports Collection, package infrastructure, and package maintenance and installation tools.

KDE has been removed from the dvd1.iso image to fit within the 4.7 GB DVD size limit, and editors/emacs and editors/vim have been added. 142df248ac06.

Packaging Changes

zstd has been packaged as a separate library and program package, similar to zlib, bzip2, and xz. The zstd package has been included in the minimal package set, ensuring it remains installed by default. 8c61751d078e. (Sponsored by https://www.patreon.com/bsdivy)

Package repository configuration changes redirect package requests from pkgbase.freebsd.org to pkg.freebsd.org mirrors, adding approximately 70 seconds to pkgbase system installation/upgrade operations. Systems with 15.0-PRERELEASE, ALPHA, or BETA installations become orphaned as they expect packages signed with old pkg keys rather than new pkgbase signing keys. 0c87d29a54da.

OpenPAM has been moved to a separate 'pam' package, allowing systems without PAM (e.g., jails, containers) to avoid installing PAM modules. The pam package is included in minimal installation sets by default, but custom or embedded systems can omit it. 95cc7f59b7ce. (Sponsored by https://www.patreon.com/bsdivy)

The installworld and installkernel targets are now blocked on systems using pkgbase to prevent package database inconsistencies. Users can override this check with DESTDIR=/ if needed. ef82bdc864c5. (Sponsored by https://www.patreon.com/bsdivy)

Firmware packages from the kmods repository have been included on the DVD installation media, ensuring that firmware modules are usable on the release version. b0fbed20ceb9. (Sponsored by https://www.patreon.com/cperciva)

The ext2 and ntfs packages have been added to release media to assist users in transferring packages from Linux or Windows systems. 8c8ec2cdc9a9.

General Notes Regarding Future FreeBSD Releases


Last modified on: May 19, 2026 by Vladlen Popolitov