git: b38ef0fa77 - main - 15.2/relnotes: initial informaton added
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 25 Oct 2026 11:52:17 UTC
The branch main has been updated by vladlen:
URL: https://cgit.FreeBSD.org/doc/commit/?id=b38ef0fa77682eb0b83399fd77e6b1af689fb4e9
commit b38ef0fa77682eb0b83399fd77e6b1af689fb4e9
Author: Vladlen Popolitov <vladlen@FreeBSD.org>
AuthorDate: 2026-10-25 11:52:10 +0000
Commit: Vladlen Popolitov <vladlen@FreeBSD.org>
CommitDate: 2026-10-25 11:52:10 +0000
15.2/relnotes: initial informaton added
SA and EN added, commits with Relnotes: commit message,
commits with contriib software, checked depreciation messages.
Approved by: re (implicit)
---
website/content/en/releases/15.2R/relnotes.adoc | 416 +++++++++++++++++++++++-
1 file changed, 408 insertions(+), 8 deletions(-)
diff --git a/website/content/en/releases/15.2R/relnotes.adoc b/website/content/en/releases/15.2R/relnotes.adoc
index 4a928a8ad9..5cc35bec43 100644
--- a/website/content/en/releases/15.2R/relnotes.adoc
+++ b/website/content/en/releases/15.2R/relnotes.adoc
@@ -6,8 +6,8 @@ sidenav: download
:localRel: 15.2
:releaseCurrent: 15.2-RELEASE
:releaseBranch: 15-STABLE
-:releasePrev: 15.2-RELEASE
-:releaseNext: 15.2-RELEASE
+:releasePrev: 15.1-RELEASE
+:releaseNext: 15.3-RELEASE
:releaseType: "release"
include::shared/en/urls.adoc[]
@@ -55,9 +55,217 @@ This section lists the Security Advisories and Errata Notices since {releasePrev
| Date
| Topic
-|No advisories.
-|
-|
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:19.file.asc[FreeBSD-SA-26:19.file]
+| 20 May 2026
+| Kernel use-after-free via file descriptor syscalls
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:20.fusefs.asc[FreeBSD-SA-26:20.fusefs]
+| 20 May 2026
+| Heap overflow in FUSE_LISTXATTR
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:21.ptrace.asc[FreeBSD-SA-26:21.ptrace]
+| 20 May 2026
+| Missing validation in ptrace(PT_SC_REMOTE)
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:22.libcasper.asc[FreeBSD-SA-26:22.libcasper]
+| 20 May 2026
+| man:select[2] file descriptor set overflow causes stack overflow
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:23.bsdinstall.asc[FreeBSD-SA-26:23.bsdinstall]
+| 20 May 2026
+| Remote code execution via installer Wi-Fi access point scans
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:24.cap_net.asc[FreeBSD-SA-26:24.cap_net]
+| 20 May 2026
+| Incorrect libcap_net limitation list manipulation
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:25.thr.asc[FreeBSD-SA-26:25.thr]
+| 9 June 2026
+| Missing permission check in man:thr_kill2[2]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:26.ktls.asc[FreeBSD-SA-26:26.ktls]
+| 9 June 2026
+| Arbitrary file overwrite via the KTLS receive path
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:27.sound.asc[FreeBSD-SA-26:27.sound]
+| 9 June 2026
+| Multiple vulnerabilities in the man:sound[4] mmap path
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:28.capsicum.asc[FreeBSD-SA-26:28.capsicum]
+| 9 June 2026
+| man:sigqueue[2] missing capability mode restriction
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:29.ip6_multicast.asc[FreeBSD-SA-26:29.ip6_multicast]
+| 9 June 2026
+| Use-after-free bug in the IPV6_MSFILTER socket option handler
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:30.linux.asc[FreeBSD-SA-26:30.linux]
+| 9 June 2026
+| Flaw in Linuxulator execution of setugid binaries
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:31.arm64.asc[FreeBSD-SA-26:31.arm64]
+| 9 June 2026
+| Arm CPU errata may bypass page table permission changes
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:32.elf.asc[FreeBSD-SA-26:32.elf]
+| 9 June 2026
+| ASLR bypass for setuid executables via man:procctl[2]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:33.unbound.asc[FreeBSD-SA-26:33.unbound]
+| 9 June 2026
+| Multiple vulnerabilities in unbound
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:34.vt.asc[FreeBSD-SA-26:34.vt]
+| 9 June 2026
+| Integer overflow in man:vt[4] CONS_HISTORY ioctl
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:35.openssl.asc[FreeBSD-SA-26:35.openssl]
+| 9 June 2026
+| Multiple vulnerabilities in OpenSSL
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:36.ldns.asc[FreeBSD-SA-26:36.ldns]
+| 9 June 2026
+| Insufficient response validation in the ldns stub resolver
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:37.vm.asc[FreeBSD-SA-26:37.vm]
+| 30 June 2026
+| Use-after-free in device pager page list
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:38.jail.asc[FreeBSD-SA-26:38.jail]
+| 30 June 2026
+| Jail reference count underflow
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:39.execve.asc[FreeBSD-SA-26:39.execve]
+| 30 June 2026
+| Local privilege escalation via man:execve[2] TOCTOU race
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:40.zfs.asc[FreeBSD-SA-26:40.zfs]
+| 30 June 2026
+| Multiple vulnerabilities in OpenZFS
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:41.libalias.asc[FreeBSD-SA-26:41.libalias]
+| 30 June 2026
+| Buffer overflow in libalias RTSP handler
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:42.unlinkat.asc[FreeBSD-SA-26:42.unlinkat]
+| 30 June 2026
+| man:unlinkat[2] ignores AT_RESOLVE_BENEATH flag
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:43.tcp.asc[FreeBSD-SA-26:43.tcp]
+| 30 June 2026
+| Use-after-free in TCP RACK stack option handler
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:44.posixshm.asc[FreeBSD-SA-26:44.posixshm]
+| 30 June 2026
+| Multiple vulnerabilities in POSIX largepage objects
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:45.audit.asc[FreeBSD-SA-26:45.audit]
+| 30 June 2026
+| Incorrect audit records for man:ptrace[2] syscall requests
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:46.ktls.asc[FreeBSD-SA-26:46.ktls]
+| 30 June 2026
+| Remote DOS via uninitialized memory access in KTLS receive
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:49.iconv.asc[FreeBSD-SA-26:49.iconv]
+| 30 June 2026
+| Multiple vulnerabilities in man:iconv[3]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:50.kqueue.asc[FreeBSD-SA-26:50.kqueue]
+| 29 July 2026
+| Use-after-free in kqueue copy-on-fork
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:51.ktimer.asc[FreeBSD-SA-26:51.ktimer]
+| 29 July 2026
+| Kernel stack disclosure via man:timer_settime[2]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc[FreeBSD-SA-26:52.if_wg]
+| 29 July 2026
+| Missing MAC validation in man:wg[4] packet decryption
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:53.ktrace.asc[FreeBSD-SA-26:53.ktrace]
+| 29 July 2026
+| man:ktrace[2] privilege incorrectly validated in jails
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:54.sysvsem.asc[FreeBSD-SA-26:54.sysvsem]
+| 29 July 2026
+| Heap out-of-bounds access in man:semctl[2]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:55.elf.asc[FreeBSD-SA-26:55.elf]
+| 29 July 2026
+| Race condition in ELF core dump segment counting
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:56.hwpmc.asc[FreeBSD-SA-26:56.hwpmc]
+| 25 August 2026
+| hwpmc fails to detach PMCs during exec credential transitions
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:57.unix.asc[FreeBSD-SA-26:57.unix]
+| 25 August 2026
+| Use-after-free in unix SOCK_STREAM message handling
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:58.sound.asc[FreeBSD-SA-26:58.sound]
+| 25 August 2026
+| Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:59.mac_do.asc[FreeBSD-SA-26:59.mac_do]
+| 25 August 2026
+| Unauthorized credential switching
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:60.ppp.asc[FreeBSD-SA-26:60.ppp]
+| 25 August 2026
+| Multiple vulnerabilities in man:ppp[8]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:61.openssl.asc[FreeBSD-SA-26:61.openssl]
+| 25 August 2026
+| Multiple vulnerabilities in OpenSSL
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:62.tty.asc[FreeBSD-SA-26:62.tty]
+| 25 August 2026
+| Kernel use-after-free via tty ioctls
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:63.posixshm.asc[FreeBSD-SA-26:63.posixshm]
+| 25 August 2026
+| TOCTOU race in POSIX shared memory large page configuration
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:64.sysvsem.asc[FreeBSD-SA-26:64.sysvsem]
+| 29 September 2026
+| Heap out-of-bounds access in man:semop[2]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:65.kqueue.asc[FreeBSD-SA-26:65.kqueue]
+| 29 September 2026
+| Memory safety bugs in kqueue copy-on-fork implementation
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:66.jail.asc[FreeBSD-SA-26:66.jail]
+| 29 September 2026
+| Multiple jail filesystem root escapes
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:67.ktls.asc[FreeBSD-SA-26:67.ktls]
+| 29 September 2026
+| Remote DoS via receive-side kernel TLS
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:68.openssl.asc[FreeBSD-SA-26:68.openssl]
+| 29 September 2026
+| Out-of-bounds read in OpenSSL DTLS retransmission
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:69.udp.asc[FreeBSD-SA-26:69.udp]
+| 29 September 2026
+| IPv6 UDP man:sendto[2] bypasses jail loopback restriction
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:70.tcp.asc[FreeBSD-SA-26:70.tcp]
+| 14 October 2026
+| Remotely triggerable buffer overflow in tcp_rack
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:71.sound.asc[FreeBSD-SA-26:71.sound]
+| 14 October 2026
+| TOCTOU race between man:sound[4] buffer resizing and mmap
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:72.bhyve.asc[FreeBSD-SA-26:72.bhyve]
+| 14 October 2026
+| Multiple vulnerabilities in bhyve device models
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:73.caroot.asc[FreeBSD-SA-26:73.caroot]
+| 21 October 2026
+| TLS certificate store update due to eMudhra compromise
|===
@@ -71,10 +279,53 @@ This section lists the Security Advisories and Errata Notices since {releasePrev
| Date
| Topic
-|No notices.
-|
-|
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:13.freebsd-update.asc[FreeBSD-EN-26:13.freebsd-update]
+| 20 May 2026
+| freebsd-update attempts to merge a generated file
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:14.syslogd.asc[FreeBSD-EN-26:14.syslogd]
+| 9 June 2026
+| man:syslogd[8] memory leak in casper_ttymsg()
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:16.arm64.asc[FreeBSD-EN-26:16.arm64]
+| 30 June 2026
+| 32-bit man:setcontext[2] and man:swapcontext[2] fail on arm64
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:17.rpcsec_tls.asc[FreeBSD-EN-26:17.rpcsec_tls]
+| 30 June 2026
+| Socket refcount underflow in the NFS server
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc[FreeBSD-EN-26:18.tzdata]
+| 29 July 2026
+| Timezone database information update
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:19.zfs.asc[FreeBSD-EN-26:19.zfs]
+| 29 July 2026
+| Race conditions in zvol device management
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:20.microcode.asc[FreeBSD-EN-26:20.microcode]
+| 25 August 2026
+| Early loading of Intel CPU microcode fails for some CPUs
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:23.syslogd.asc[FreeBSD-EN-26:23.syslogd]
+| 29 September 2026
+| man:syslogd[8] leaks child processes when logging to a pipe
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:24.tzdata.asc[FreeBSD-EN-26:24.tzdata]
+| 29 September 2026
+| Timezone database information update
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:25.tzdata.asc[FreeBSD-EN-26:25.tzdata]
+| 14 October 2026
+| Timezone database information update
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:26.hastd.asc[FreeBSD-EN-26:26.hastd]
+| 14 October 2026
+| Multiple issues in man:hastd[8]
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:27.tcp.asc[FreeBSD-EN-26:27.tcp]
+| 14 October 2026
+| TCP timers may overflow and fire late or not at all
|===
@@ -102,23 +353,105 @@ gitref:f8b81bfc76d8[repository=src].
[[userland-config]]
=== Userland Configuration Changes
+A new man:rc.conf[5] option, `backlight_enable`, enables saving and restoring the backlight level across reboots via the man:backlight[8] rc.d service. The service is disabled by default to avoid interfering with desktop environments.
+gitref:5245187af22b[repository=src].
+
[[userland-programs]]
=== Userland Application Changes
+Deprecated control values have been removed from man:mixer[8]; users relying on these legacy controls must use the current mixer command interface: `on`, `off`, `toggle`, `set`, `add`, `remove` instead of `1`, `0`, `^`, `=`, `+`, `-`.
+gitref:5ec4a7bb2cdf[repository=src].
+{{< sponsored "The FreeBSD Foundation" >}}
+
[[userland-contrib]]
=== Contributed Software
+Clang on FreeBSD now defaults to the LLVM linker (ld.lld) unless explicitly overridden, avoiding unexpected use of GNU ld from the system package manager; no user action is required for default behavior.
+gitref:8d0154e64186[repository=src].
+
+expat has been updated to 2.9.0. The update addresses security advisories CVE-2026-102633 and CVE-2026-77214.
+gitref:94fd9b50590d[repository=src].
+
+man:file[1] has been updated to 5.48.
+gitref:811f6b461be4[repository=src].
+
+Kerberos has been updated to 1.22.2.
+gitref:919b10729753[repository=src].
+
+ldns has been updated to 1.9.2.
+gitref:c31042a7a944[repository=src].
+
+man:less[1] has been updated to v710.
+gitref:d3c6de9c3cab[repository=src].
+
+libarchive has been updated to 3.8.9.
+gitref:750cc0502912[repository=src].
+
+LLVM compiler infrastructure, including clang, compiler-rt, libc++, libunwind, lld, lldb, and openmp, has been updated to llvm-project 21.1.8.
+gitref:e40599641e0e[repository=src].
+
+lutok has been updated to 0.6.2.
+gitref:6dcc931d2b00[repository=src].
+
+openresolv now trims leading dots from domain names in resolvconf, which affects DNS resolution behavior for users with such configurations.
+gitref:4fff1e9f1076[repository=src].
+
+openresolv has been updated to 3.17.4.
+gitref:bdbad7b41b45[repository=src].
+
+OpenSSH has been updated to 10.4p1. This release includes security fixes, stricter transport protocol handling, and experimental post-quantum signature support that requires explicit configuration.
+gitref:f2b0910a9831[repository=src].
+{{< sponsored "The FreeBSD Foundation" >}}
+
+OpenSSL has been updated to 3.5.9. This release includes security fixes for high-severity CVEs, and users are encouraged to update.
+gitref:b97734d7f6d4[repository=src].
+
+OpenZFS has been updated to version 2.4.4.
+gitref:2c00a4216378[repository=src].
+
+sqlite3 has been updated to 3.53.3.
+gitref:c81e5aa8a52e[repository=src].
+
+tzdata has been updated to 2026e.
+gitref:961a842fdd3a[repository=src].
+
+unbound has been updated to 1.26.1.
+gitref:99c63b819cb5[repository=src].
+
+wpa has been updated to 2.12.
+gitref:3e4c62b92093[repository=src].
+
+xz has been updated to 5.8.4.
+gitref:6513d742f155[repository=src].
+
+zstd has been updated to 1.5.7, bringing performance improvements and bug fixes to the compression library and utilities used by the base system.
+gitref:ff426ceef657[repository=src].
+
[[userland-deprecated-programs]]
=== Deprecated Applications
[[userland-libraries]]
=== Runtime Libraries and API
+The resolver option parser in libc now rejects trailing garbage in option names and values instead of silently truncating them. Numerical arguments that fail to parse, including negative or overflowing values, no longer alter the current setting.
+gitref:491337c8a21a[repository=src].
+
+The /etc/protocols database has been updated to the IANA protocol number list dated 2026-03-09, with documentation of deprecated protocol numbers and the note that protocol 240 (pfsync) is not assigned by IANA.
+gitref:d661121660a0[repository=src].
+
[[cloud]]
== Cloud Support
This section covers changes in support for cloud environments.
+EC2 desktop AMIs now boot to a KDE desktop with xrdp enabled, provide a random password retrievable via the EC2 GetPasswordData API, and improve compatibility with EC2 Windows AMIs.
+gitref:80c5a04f88c6[repository=src].
+{{< sponsored "Amazon" >}}
+
+EC2 "small" images no longer enable firstboot_pkgs by default. Users who require package installation at instance launch time must set firstboot_pkgs_enable="YES" in /etc/rc.conf.
+gitref:a9e71a2e1ade[repository=src].
+{{< sponsored "Amazon" >}}
+
[[kernel]]
== Kernel
@@ -127,6 +460,13 @@ This section covers changes to kernel configurations, system tuning, and system
[[kernel-general]]
=== General Kernel Changes
+A new security knob allows unprivileged access to the kernel environment (kenv) to be disabled. When enabled, only privileged processes, including jailed root, can read kernel environment variables, limiting exposure of sensitive information.
+gitref:da9d26a215a6[repository=src].
+
+The man:mac_do[4] security module now supports configurable executable paths, allowing up to eight paths to be authorized for credential change requests. This enables thin jail scenarios where man:mdo[1] is not at its canonical path and permits other userland programs to use man:setcred[2]. Configuration is available via the `security.mac.do.exec_paths` sysctl and the `mac.do.exec_paths` jail parameter.
+gitref:8cbd56ec1c54[repository=src].
+{{< sponsored "Google LLC (GSoC 2025); The FreeBSD Foundation (review, commit)" >}}
+
[[drivers]]
== Devices and Drivers
@@ -135,6 +475,29 @@ This section covers changes and additions to devices and device drivers since {r
[[drivers-device]]
=== Device Drivers
+The man:em[4] and man:igb[4] drivers have been reworked for Wake-on-LAN, including corrected wake capability advertisement and programming, per-controller NVM handling, restored receive filters after suspend, and updated man page documentation. Wake from S3 is now supported on additional controllers such as the 82576 and 82574L, while unsupported 82541ER wake is no longer advertised.
+gitref:0cab2bc676d7[repository=src].
+{{< sponsored "BBOX.io" >}}
+
+The man:tpm[4] driver is re-enabled in amd64 GENERIC and MINIMAL kernels and in the MPC85XX and QORIQ64 PowerPC configurations, restoring TPM support and entropy harvesting after suspend/resume fixes for both TPM 1.2 and TPM 2.0.
+gitref:7fdc748c0c3d[repository=src].
+{{< sponsored "BBOX.io" >}}
+
+The man:ixgbe[4] driver has received numerous SR-IOV improvements. SR-IOV is now enabled on E610 physical functions (up to 63 virtual functions), and malicious-driver detection with per-pool recovery is supported on X550-family adapters (including X552/X553), with VF traffic held disabled until the reset handshake completes. VFs now support up to three secondary unicast MAC filters, honor the allow-promisc IOV property for multicast and promiscuous modes, and correctly preserve VLAN ownership and per-VF isolation (including delivery of PF-assigned port VLAN traffic to VFs as untagged). Anti-spoofing policy for VF MAC/VLAN is enforced, protecting LLDP and flow-control Ethertypes, with per-VF spoof-event accounting.
+gitref:34208cb35076[repository=src],
+gitref:ad9149c3aabe[repository=src],
+gitref:626a367c2b72[repository=src],
+gitref:1ff14169af4b[repository=src],
+gitref:06a514be60c8[repository=src],
+gitref:59bd5fc94c54[repository=src].
+{{< sponsored "Dirk-Willem van Gulik from Web Weaving (E610 hardware); BBOX.io" >}}
+
+The man:ixgbe[4] driver now recognizes 10GBase-BX BiDi SFP+ optical modules and reports their link speed and reach correctly, enabling single-strand single-mode 10 Gb/s links on supported Intel adapters.
+gitref:7316de430095[repository=src].
+
+The man:ixl[4] driver now enforces SR-IOV virtual function VLAN policies, with access VFs restricted to a hardware PVID and trunk VFs limited to 16 VLANs (VLAN 0 implicitly admitted). Hardware VLAN anti-spoofing and untrusted-VF limits of 18 MAC addresses and 16 VLANs are applied, and the effective policy is reported through the VF status interface and documented in ixl(4).
+gitref:3be664785727[repository=src].
+
[[drivers-removals]]
=== Deprecated and Removed Drivers
@@ -146,6 +509,16 @@ This section covers changes and additions to file systems and other storage subs
[[storage-general]]
=== General Storage
+man:nullfs[4] now permits mounting a VSOCK file directly on top of another socket, allowing containerized processes to share man:unix[4] sockets without exposing an entire directory. The change improves secure socket sharing for container workflows.
+gitref:1853976b7522[repository=src].
+
+A new rc.d script and devd configuration allow automatic enlargement of the final partition and its UFS filesystem or ZFS pool when a disk grows at runtime. Enabled by setting growfs_postboot_enable=YES in /etc/rc.conf, it supports VM and cloud environments where virtual disks are expanded after boot.
+gitref:ba004afc874b[repository=src].
+{{< sponsored "Amazon" >}}
+
+The msdosfs file system now handles file names containing surrogate pair characters, allowing access to files and directories with emoji or other supplementary-plane Unicode characters. Media written on other operating systems with such names are fully readable.
+gitref:8f3585150016[repository=src].
+
[[boot]]
== Boot Loader Changes
@@ -162,6 +535,16 @@ This section describes changes that affect networking in FreeBSD.
[[network-general]]
=== General Network
+The resolver sortlist parser in libc is reimplemented, restoring the ability to configure address sorting via the sortlist directive. IPv4 and IPv6 addresses with optional masks or prefix lengths are accepted, and man:resolver[5] is updated accordingly.
+gitref:55f219b3f766[repository=src].
+
+A new sysctl tunable allows disabling kTLS receive offload independently of transmit offload, providing a mitigation for TLS receive path security issues.
+gitref:4d3f5d2ca43c[repository=src].
+{{< sponsored "Netflix; Chelsio Communications" >}}
+
+rc.firewall now supports on-disk lists for `firewall_allowservices` and `firewall_trusted`: when a list element is an absolute path, the file is read and each non-comment, non-blank line's first word is treated as an address or subnet to add to the list.
+gitref:3aec74070b0d[repository=src].
+
[[hardware]]
== Hardware Support
@@ -172,6 +555,10 @@ Please see link:https://www.freebsd.org/releases/{localRel}R/hardware[the list o
[[hardware-virtualization]]
=== Virtualization Support
+The bhyve NVMe emulation now stores a manually configured eui64 value in the correct byte order, so the identifier reported to the guest matches the value specified by the user. Previously the value was byte-swapped on little-endian hosts.
+gitref:11df1d931657[repository=src].
+{{< sponsored "The FreeBSD Foundation" >}}
+
[[documentation]]
== Documentation
@@ -180,6 +567,19 @@ This section covers changes to manual (man:man[1]) pages and other documentation
[[man-pages]]
=== Man Pages
+A manual page has been added for the man:aq[4] driver, documenting the Aquantia AQtion Ethernet driver and its supported hardware and tunables.
+gitref:08dbff58cd21[repository=src].
+{{< sponsored "The FreeBSD Foundation" >}}
+
+A new man page, man:groups[7], documents the standard group names used in FreeBSD, sorted by GID, with the exception of 'uucp'. Existing manual pages now cross-reference this new page.
+gitref:2c4190609c78[repository=src].
+
+The man:ports[7] reference manual page is expanded and reorganized so that key files and directories are documented in three tables, making the layout of the Ports Collection easier to understand.
+gitref:aa519edfe50a[repository=src].
+
+A new manual page, man:tcp_bblog[4], documents the TCP Blackbox Logging facility. It provides reference documentation for per-connection TCP event tracing used for debugging and performance analysis.
+gitref:c8e8fa04dc05[repository=src].
+
[[ports]]
== Ports Collection and Package Infrastructure