FreeBSD 15.2-RELEASE Release Notes

Changes in this section only affect systems installed using base system packages (sometimes called pkgbase), supported in FreeBSD 15.0 and later.

On the aarch64, armv7, powerpc64, powerpc64le and riscv64 platforms, the non-functional FreeBSD-apm package has been removed. Any existing package, if installed, should be removed after upgrading. b04fa0f8b8c5.

On the armv7, powerpc64, powerpc64le and riscv64 platforms, the non-functional FreeBSD-acpi package has been removed. Any existing package, if installed, should be removed after upgrading. 58c08517ce5d.

This release includes experimental support for cross-building base system packages on Linux and macOS hosts. The pkg(8) utility must be manually installed on the build host. 0851f28403e3, d2ce6ed7f553, f8b81bfc76d8.

A new rc.conf(5) option, backlight_enable, enables saving and restoring the backlight level across reboots via the backlight(8) rc.d service. The service is disabled by default to avoid interfering with desktop environments. 5245187af22b.

Deprecated control values have been removed from mixer(8); users relying on these legacy controls must use the current mixer command interface: on, off, toggle, set, add, remove instead of 1, 0, ^, =, +, -. 5ec4a7bb2cdf. (Sponsored by The FreeBSD Foundation)

makefs(8) now accepts an autotrim option that sets the autotrim property of the created ZFS pool to on or off, allowing imported pools to start trimming freed space without a separate zpool set step. When the option is omitted, the pool retains the default value of off. 4ff8c71df5de. (Sponsored by Rubicon Communications, LLC ()

ATF updated to version 0.26. 040ab05d3617.

Clang on FreeBSD now defaults to the LLVM linker (ld.lld) unless explicitly overridden, avoiding unexpected use of GNU ld from the system package manager; no user action is required for default behavior. 8d0154e64186.

expat has been updated to 2.9.0. The update addresses security advisories CVE-2026-102633 and CVE-2026-77214. 94fd9b50590d.

file(1) has been updated to 5.48. 811f6b461be4.

Kerberos has been updated to 1.22.2. 919b10729753.

ldns has been updated to 1.9.2. c31042a7a944.

less(1) has been updated to v710. d3c6de9c3cab.

libarchive has been updated to 3.8.11. 80c954a926c6.

LLVM compiler infrastructure, including clang, compiler-rt, libc++, libunwind, lld, lldb, and openmp, has been updated to llvm-project 21.1.8. e40599641e0e.

lutok has been updated to 0.6.2. 6dcc931d2b00, d6cf497d2a1c.

openresolv now trims leading dots from domain names in resolvconf, which affects DNS resolution behavior for users with such configurations. 4fff1e9f1076.

openresolv has been updated to 3.17.4. bdbad7b41b45.

OpenSSH has been updated to 10.4p1. This release includes security fixes, stricter transport protocol handling, and experimental post-quantum signature support that requires explicit configuration. f2b0910a9831. (Sponsored by The FreeBSD Foundation)

OpenSSL has been updated to 3.5.9. This release includes security fixes for high-severity CVEs, and users are encouraged to update. b97734d7f6d4.

OpenZFS has been updated to version 2.4.4. 2c00a4216378.

sqlite3 has been updated to 3.53.3. c81e5aa8a52e.

tzdata has been updated to 2026f. 406279104888.

unbound has been updated to 1.26.1. 99c63b819cb5.

wpa has been updated to 2.12. 3e4c62b92093.

xz has been updated to 5.8.4. 6513d742f155.

zstd has been updated to 1.5.7, bringing performance improvements and bug fixes to the compression library and utilities used by the base system. ff426ceef657.

The resolver option parser in libc now rejects trailing garbage in option names and values instead of silently truncating them. Numerical arguments that fail to parse, including negative or overflowing values, no longer alter the current setting. 491337c8a21a.

The /etc/protocols database has been updated to the IANA protocol number list dated 2026-03-09, with documentation of deprecated protocol numbers and the note that protocol 240 (pfsync) is not assigned by IANA. d661121660a0.

A new security knob allows unprivileged access to the kernel environment (kenv) to be disabled. When enabled, only privileged processes, including jailed root, can read kernel environment variables, limiting exposure of sensitive information. da9d26a215a6.

The mac_do(4) security module now supports configurable executable paths, allowing up to eight paths to be authorized for credential change requests. This enables thin jail scenarios where mdo(1) is not at its canonical path and permits other userland programs to use setcred(2). Configuration is available via the security.mac.do.exec_paths sysctl and the mac.do.exec_paths jail parameter. 8cbd56ec1c54. (Sponsored by Google LLC (GSoC 2025); The FreeBSD Foundation (review, commit))

The em(4) and igb(4) drivers have been reworked for Wake-on-LAN, including corrected wake capability advertisement and programming, per-controller NVM handling, restored receive filters after suspend, and updated man page documentation. Wake from S3 is now supported on additional controllers such as the 82576 and 82574L, while unsupported 82541ER wake is no longer advertised. 0cab2bc676d7. (Sponsored by BBOX.io)

The igb(4) driver now supports SR-IOV on Intel 82576 and I350 controllers, with up to seven virtual functions (VFs) per physical function (PF). Enabling SR-IOV requires options PCI_IOV, MSI-X, and a single PF transmit/receive queue pair; see igb(4) for the required loader tunables.

Virtual functions now use the separate igbv(4) driver, which adds Hyper-V support and can provide the accelerated data path for hn(4). On Hyper-V, VFs support an MTU of up to 1500 bytes and host-assigned access VLANs with untagged guest traffic. Guest VLAN trunks require the synthetic hn(4) data path with SR-IOV disabled for the virtual network adapter on the host.

3a0d13751d21. (Sponsored by BBOX.io)

The tpm(4) driver is re-enabled in amd64 GENERIC and MINIMAL kernels and in the MPC85XX and QORIQ64 PowerPC configurations, restoring TPM support and entropy harvesting after suspend/resume fixes for both TPM 1.2 and TPM 2.0. 7fdc748c0c3d. (Sponsored by BBOX.io)

The ixgbe(4) driver has received numerous SR-IOV improvements. SR-IOV is now enabled on E610 physical functions (up to 63 virtual functions), and malicious-driver detection with per-pool recovery is supported on X550-family adapters (including X552/X553), with VF traffic held disabled until the reset handshake completes. VFs now support up to three secondary unicast MAC filters, honor the allow-promisc IOV property for multicast and promiscuous modes, and correctly preserve VLAN ownership and per-VF isolation (including delivery of PF-assigned port VLAN traffic to VFs as untagged). Anti-spoofing policy for VF MAC/VLAN is enforced, protecting LLDP and flow-control Ethertypes, with per-VF spoof-event accounting. 34208cb35076, ad9149c3aabe, 626a367c2b72, 1ff14169af4b, 06a514be60c8, 59bd5fc94c54. (Sponsored by Dirk-Willem van Gulik from Web Weaving (E610 hardware); BBOX.io)

The ixgbe(4) driver now recognizes 10GBase-BX BiDi SFP+ optical modules and reports their link speed and reach correctly, enabling single-strand single-mode 10 Gb/s links on supported Intel adapters. 7316de430095.

The ixl(4) driver now enforces SR-IOV virtual function VLAN policies, with access VFs restricted to a hardware PVID and trunk VFs limited to 16 VLANs (VLAN 0 implicitly admitted). Hardware VLAN anti-spoofing and untrusted-VF limits of 18 MAC addresses and 16 VLANs are applied, and the effective policy is reported through the VF status interface and documented in ixl(4). 3be664785727.

The ixgbe(4) driver now isolates a virtual function whose guest driver repeatedly causes transmit failures after a reset, preventing one faulty guest from leaving an 82599 or X540 physical function unusable for other guests. This keeps the physical port available to all other guests on the same adapter. de91b2a0c393.

The ntsync(4) driver provides kernel-level support for Windows NT synchronization primitives via a /dev/ntsync device compatible with the Linux interface used by Wine and Proton. This allows Wine-based applications and games to perform thread synchronization in the kernel instead of user space, reducing overhead and improving performance and stability for multi-threaded Windows software on FreeBSD. 43702cfc0ccb.

nullfs(4) now permits mounting a VSOCK file directly on top of another socket, allowing containerized processes to share unix(4) sockets without exposing an entire directory. The change improves secure socket sharing for container workflows. 1853976b7522.

A new rc.d script and devd configuration allow automatic enlargement of the final partition and its UFS filesystem or ZFS pool when a disk grows at runtime. Enabled by setting growfs_postboot_enable=YES in /etc/rc.conf, it supports VM and cloud environments where virtual disks are expanded after boot. ba004afc874b. (Sponsored by Amazon)

The msdosfs file system now handles file names containing surrogate pair characters, allowing access to files and directories with emoji or other supplementary-plane Unicode characters. Media written on other operating systems with such names are fully readable. 8f3585150016.

zpool-export(8) now returns EBUSY when a zvol block device is in use, instead of hanging indefinitely, matching the behavior for mounted ZFS datasets. cc010bbc3491.

The UEFI boot loader now applies command-line overrides earlier, so console selection via efibootmgr(8) takes effect before the GELI passphrase prompt. This provides serial console access on systems that do not advertise a serial console through ConOut. ea041ed323ee.

bhyveload(8) now releases its host /boot handle before executing guest boot scripts, limiting the sandbox’s exposure to the host /boot directory. 84ec2d3b67df.

The boot loader now rejects ELF files with inconsistent segment sizes (where a segment’s file size exceeds its in-memory size), preventing malformed kernels from being loaded. Normal boot is unaffected. 6e4ef01c603c.

The boot0cfg(8) utility now accepts a regular file as its trailing argument, not just a live disk provider. This allows users to configure boot0(8) parameters in a binary before flashing it with gpart(8) bootcode or using it with mkimg(1). 15a0a7d525cf.

The EFI loader now allocates trampoline memory as executable code rather than data, so firmware that enforces non-executable data protections can boot it successfully. The trampoline is the small stub that hands control from the loader over to the kernel. This improves boot reliability on affected systems. 6db7fa3765ae. (Sponsored by The FreeBSD Foundation)

The boot loader now recognizes ELF constructor sections and passes them to the kernel, allowing constructors to run during boot. This is required for KASAN. 984a3970b16f. (Sponsored by The FreeBSD Foundation)

The boot loader’s graphical menu no longer suffers from display corruption caused by incorrect shadow buffer offset handling. 4a1a1bf3afc7. (Sponsored by The FreeBSD Foundation)

The zfskeys boot script no longer pauses boot to ask for an interactively entered ZFS passphrase unless both zfskeys_enable and zfskeys_prompt_enable are set to YES in rc.conf(5). This restores the previous behavior of not prompting by default. 3f73758036c7.

loader.efi(8) on a ZFS root under UEFI Secure Boot with mac_veriexec(4) enabled no longer reports a spurious no entry error. Users booting such a configuration should update the EFI loader and re-sign it. 6b1371fca772. (Sponsored by Defenso)

The lualoader adds be-list and be-switch commands so boot environments can be listed and switched directly from the loader command prompt, with matching man page updates. f77062f506f7.

The EFI boot loader no longer fails to boot in a situation where it previously jumped to the wrong code, fixing a load failure that could prevent booting on affected systems. 95632c90ba32. (Sponsored by Netflix)

The boot loader’s graphics framebuffer code now batches updates through a shadow buffer instead of flushing on every operation, improving boot time on some platforms. 1802f2ca7215. (Sponsored by The FreeBSD Foundation)

The boot loader’s Lua menu now follows symbolic links when locating bootable kernels, so symlinked kernel paths in /boot are detected and offered in the boot menu. 8c78774107a7.

The resolver sortlist parser in libc is reimplemented, restoring the ability to configure address sorting via the sortlist directive. IPv4 and IPv6 addresses with optional masks or prefix lengths are accepted, and resolver(5) is updated accordingly. 55f219b3f766.

A new sysctl tunable allows disabling kTLS receive offload independently of transmit offload, providing a mitigation for TLS receive path security issues. 4d3f5d2ca43c. (Sponsored by Netflix; Chelsio Communications)

rc.firewall now supports on-disk lists for firewall_allowservices and firewall_trusted: when a list element is an absolute path, the file is read and each non-comment, non-blank line’s first word is treated as an address or subnet to add to the list. 3aec74070b0d.

ifconfig(8) -v output now reports SR-IOV virtual function status for supported NICs. The display groups optional identity, initialization, resource, VLAN, administrator policy, protocol, traffic-permission, and fault-containment fields, while omitted values remain distinct from zero or false. Device-neutral PCI attachment and passthrough state remain available through iovctl(8) -L. d36050dc99ea. (Sponsored by Intel Corporation (initial version) | BBOX.io)

The iflib(4) framework exports a per-device tx_watchdog_events counter at dev.<driver>.<unit>.iflib.tx_watchdog_events. The em(4), igb(4), and igc(4) drivers no longer count transmit watchdog resets as output errors, preventing those error counters from overstating packet loss. f7ea2d561288.

The bhyve NVMe emulation now stores a manually configured eui64 value in the correct byte order, so the identifier reported to the guest matches the value specified by the user. Previously the value was byte-swapped on little-endian hosts. 11df1d931657. (Sponsored by The FreeBSD Foundation)

man(1) now searches translated manual pages in pure language subdirectories such as share/ja/man1, share/de/man1, and share/ru/man1, in addition to locale-style paths. This allows localized pages from ports that use only $lang directories to be found instead of silently falling back to English. 9fe7f514ef24.

A manual page has been added for the aq(4) driver, documenting the Aquantia AQtion Ethernet driver and its supported hardware and tunables. 08dbff58cd21. (Sponsored by The FreeBSD Foundation)

A new man page, groups(7), documents the standard group names used in FreeBSD, sorted by GID, with the exception of 'uucp'. Existing manual pages now cross-reference this new page. 2c4190609c78.

The ports(7) reference manual page is expanded and reorganized so that key files and directories are documented in three tables, making the layout of the Ports Collection easier to understand. aa519edfe50a.

A new manual page, tcp_bblog(4), documents the TCP Blackbox Logging facility. It provides reference documentation for per-connection TCP event tracing used for debugging and performance analysis. c8e8fa04dc05.