NetBSD 11.0 ships with three unpatched security bugs — and says so openly

After a long delay, the NetBSD project has released version 11.0, and it’s doing something unusual: shipping with three known, unfixed security issues and documenting them in the announcement rather than holding the release hostage to a perpetually moving target. The team frames this as a direct consequence of the AI era, arguing that the volume of reported and suspected vulnerabilities has climbed so sharply that waiting for a completely clean slate is no longer realistic. Transparency, in their view, beats indefinite slippage.

The three flagged issues are relatively contained. A missing privilege check in the hdaudio(4) driver (PR 60492) lets local users reach ioctl commands they shouldn’t, but it has a trivial workaround — removing /dev/hdaudio* leaves audio working. The other two, a remotely triggerable null-pointer dereference in ipfilter (PR 60484) and a use-after-free in pf’s fragment reassembly (PR 60485), sit in packet filters that aren’t compiled into any released kernel by default, so exposure is minimal out of the box. Fixes are already staged for the stable branch and slated for 11.1.

The rest of the delay came from more mundane engineering realities: waiting on upstream third-party components to cut their own stable releases, running full release candidates so users could test, and the sheer mechanical cost of building, checksumming, signing, and distributing images for every supported architecture — a pipeline still gated by manual steps and network transfer times. NetBSD 11.1, carrying the three fixes, is targeted for release within roughly two months.