Announcing NetBSD 9.5 (August 31, 2026)

Quick links for the impatient:

Download 9.5 from our CDN: amd64 USB, amd64 CD, various ARM devices, full release dir with everything else.

Hashes, signed with the NetBSD Security Officer's PGP key, of all files in the distribution.

Note: this will be the final release from the netbsd-9 stable branch and also marks the end-of-support for this branch. There will be no further security pullups to this branch! Users running netbsd-9 in production are strongly encouraged to transition to a newer release series, such as netbsd-11 or netbsd-10.

Changes since 9.4

System improvements and hardware support

  • build.sh - various tools build fixes for newer compilers and non-NetBSD platforms.
  • aarch64 - fixed thread-local storage support.
  • x86 - fixed MSI/MSI-X configuration on some machines.
  • mbsnrtowcs(3), wcsnrtombs(3) - added manual pages.
  • acpiout(4) - fixed display brightness controls on certain machines.
  • eap(4) - restore the full set of supported hardware encodings from netbsd-7.
  • uftdi(4) - added support for a range of Brainboxes USB to Serial adapters.
  • urtwn(4) - added support for Mercusys MW150USV2 USB Wi-Fi adapters.
  • urtwn(4) - added support for Asus USB-N10 Nano B1 Wi-Fi adapters.
  • &man.viaide.4 - various improvements in support for several controllers.

Security and reliabiliy

  • ipf - fixed a remotely triggerable null pointer dereference in icmp6 parsing.
  • netinet - fixed a 4-byte leak of kernel stack data through TCP timestamps.
  • netinet - added a mitigation for TCP SegmentSmack.
  • netinet6 - avoid dropping 32-byte fragmented IPv6 packets.
  • zfs - fixed possible data corruption on FIOSEEKDATA/FIOSEEKHOLE (PR 58111).
  • tic(1) - respect user’s current umask (PR 58270)
  • vi(1) - fixed crash on certain substitutions (PR 57630).
  • clock_gettime(2) - fixed implementation of CLOCK_PROCESS/THREAD_CPUTIME_ID so they are monotonic.
  • iconv(3) - fixed a use-after-free in VIQR encoding.
  • bpf(4) - fixed deadlocks and MP-safety issues.
  • hdaudio(4) - added access checks so unprivileged users can’t change the configuration.
  • ucom(4) - fixed input queue corruption on open-after-close.
  • gpt(8) - disallow partitions with null UUIDs, generate one instead.
  • fsck_ffs(8) - fixed crashes on filesystems with more than 2^32 blocks.
  • syslogd(8) - various memory leak fixes.
  • telnetd(8) - fixed "telnet -l", telnetd asking for authentication twice (PR 58127, PR 58787).
  • unbound(8) - applied upstream fix for CVE-2025-11411.

Third-party components

  • Xorg(1) - applied upstream security fixes for xorg-server, libXfont2, and libXpm.
  • openssl(1) - applied upstream fixes for various security issues.
  • sshd(8) - applied upstream fixes for various security issues.
  • tzdata - updated to tzdata2026b.
  • xkbcomp - updated to 1.5.0.