NetBSD 11.0 Released: What’s New, How to Install, and What’s Still Open

You know that moment when you download an operating system release and realize the hardest part isn’t the install… it’s making sense of the files you got? NetBSD 11.0 is one of those releases where the “getting started” details matter: the project ships multiple kinds of install media, updated installer behavior, and (unusually transparently) a short list of open security pull-ups that will land after the release.

What changes most when moving to NetBSD 11.0? The headline story is a blend of new platform support (including modern RISC-V and ARM attention), deeper POSIX (and C language interface) alignment, and firewall and kernel improvements—plus practical guidance on how to boot, write media, and verify what you downloaded.

First: what NetBSD “11.0” actually means

NetBSD is a Unix-like operating system built around a kernel (the core program that talks to hardware) and a userland (the utilities and system software you interact with, like shells, filesystems tools, and networking daemons). A “major release” like 11.0 usually means a large set of stability improvements, new device support, and changes across multiple subsystems.

NetBSD also supports many “ports.” In this context, a port is a platform-specific adaptation: the same OS idea, but with the right low-level glue for a given CPU family and hardware environment.

The installation media got a little pickier

A small detail can save hours: NetBSD’s release media now comes in variants meant for different drive sizes and write methods. The project explicitly notes that the ISO images are split so CD-ROM-friendly images stay under 700MB, and that full-sized DVD images are provided with a “-dvd.iso” name. If you’re using flash-based media like a USB drive, you’re meant to use the “.img” files rather than “.iso” files.

That distinction is confusing at first, because ISO and IMG both look like “files you write to a drive.” But they usually behave differently:

• ISO is typically an optical-disc image format (meant for CD/DVD-style media layouts).
• IMG is commonly a raw or near-raw disk/boot image intended to be written to flash storage.

Booting on amd64: the installer’s “quick path”

On amd64 (meaning modern 64-bit Intel/AMD systems), the installation notes recommend a flow: fetch install files, write the boot image to media, boot, and then let the installer fetch the remaining distribution sets if the machine has networking.

Here’s the kind of process you’ll see in the official amd64 installation notes for NetBSD 11.0:

1. Prepare the boot image
   Many NetBSD install images are gzipped, so you’ll likely run a decompression step first.

gunzip NetBSD-11.0-amd64-install.img.gz

2. Write the image to USB
   On Unix-like hosts, the notes show a pattern using dd (a raw byte copy utility):

# Replace /dev/rsd0d with your correct target device.
dd if=NetBSD-11.0-amd64-install.img of=/dev/rsd0d bs=32k

bs here is “block size”: how many bytes dd copies per chunk. A block size like 32k can be a reasonable balance for throughput and reliability.

3. Boot the installer
   The installer uses a kernel and a minimal environment to bring up disk/network operations, then pulls the actual binary sets you need.

Why ACPI might bite on some machines

A subtle but important installer behavior: the default kernel on the boot media uses ACPI (Advanced Configuration and Power Interface), a standardized hardware interface for power management and device discovery. The notes warn that some systems have buggy ACPI implementations, and you can boot with ACPI disabled by using the boot prompt option boot -2.

This is the kind of thing that feels “mystical” until you’ve seen it: the installer is bootstrapping hardware support, and ACPI is one of the first things it tries to use.

What’s new under the hood

NetBSD 11.0’s release highlights (as described in the project’s release material) include several changes worth translating into plain language.

1) New RISC-V support: a serious expansion of platform coverage

RISC-V is an open instruction set architecture (the “CPU language” level that defines how programs run). NetBSD 11.0 is described as supporting 64-bit RISC-V platforms, including devices in the StarFive JH71XX ecosystem and running environments like QEMU.

Why should you care even on x86? Because it’s a sign of ongoing investment in multi-platform kernel correctness and tooling.

2) POSIX.1-2024 and C23 interface alignment

POSIX (Portable Operating System Interface) is a standard that defines how operating systems should behave for common tasks like files, processes, and threads. POSIX.1-2024 updates that contract.

Similarly, C23 is a revision of the C programming language. The release material points to enhanced compliance with POSIX.1-2024 and C23 “programming interface standards,” meaning the system call and library behavior is moving closer to what portable software expects.

3) Linux compatibility grows (compat_linux)

NetBSD offers a Linux compatibility layer called compat_linux. Rather than “running Linux,” it provides implementations for many Linux system calls so Linux-targeted programs can get further than they otherwise would.

The release highlights mention Linux features like epoll—a Linux event notification mechanism. Under NetBSD, this is implemented “around kqueue.” kqueue is NetBSD’s event notification API (a different interface that can watch file descriptors for I/O events). The key idea is: compatibility layers often translate one event model to another.

4) Firewall work in npf

NetBSD’s newer firewall framework is npf. The notes highlight improvements such as layer 2 and user/group filtering.

A beginner translation: firewalls don’t just match “IP and port.” Modern systems filter based on richer criteria, like packet structure and who the process is (user/group), which helps reduce “whack-a-mole” rules.

5) A fast-boot MICROVM kernel for x86

For virtualization, NetBSD describes a dedicated MICROVM kernel for extremely fast virtual machine boot. The release notes mention techniques like PVH boot (a virtualized boot method) and VirtIO MMIO.

VirtIO (Virtual I/O) is a paravirtualized device framework. “MMIO” means the virtual device communicates via memory-mapped I/O registers rather than PCI-style mechanisms.

These details mostly matter when you’re building or running virtual machines, but they also reflect how NetBSD is tuning boot paths for modern cloud-like environments.

Filesystem changes: extended attributes and ACLs on FFS

One of the biggest “practical” release notes entries lives in the amd64 install documentation: NetBSD 11.0 supports extended attributes and access control lists (ACLs) on FFS.

Let’s translate the terms:

• FFS is the classic Fast File System used by many BSD systems.
• Extended attributes are extra key/value metadata stored alongside files.
• ACLs are more expressive permission rules than the traditional Unix owner/group/other mode bits.

But there’s a compatibility twist. For new installations, the installer disables these features by default so the filesystem remains compatible with older NetBSD releases and can be mounted read-only by other systems.

If you want the installed filesystem to support extended attributes, the installer suggests switching the filesystem type to FFSv2ea in the partitioning menu. It also notes you can convert later using fsck_ffs(8).

Why this matters when installing

If you care about metadata and fine-grained permissions, you want to decide at install time. You can’t “install later” something that changes how the filesystem encodes metadata without planning around conversion.

Security transparency: open pull-ups and what you can do today

This is the part that feels unusual because most release announcements pretend everything is perfectly sealed. NetBSD’s 11.0 release notes explicitly say they can’t publish a release without open security issues, and that they’re choosing to be transparent.

A pull-up request is a development process term: it means “take a fix from a later place in the development tree and apply it to a stable branch.” The associated GNATS problem reports (PRs) track the issues.

The release blog lists three open items:

1. hdaudio(4): apply access checks to ioctl commands
   The stated problem is a missing local-user privilege check. The manual workaround is to remove /dev/hdaudio* while you wait for the stable-branch pull-up to be committed. Audio is expected to remain functional.

2. ipfilter: fix remotely triggerable null pointer dereference
   The notes emphasize that IPF (ipfilter) is not included in any released kernel by default. That wording matters: “not included by default” usually means typical installations won’t expose the vulnerable code path unless you intentionally enable it.

3. pf: fix use-after-free in fragment reassembly
   pf is described as deprecated and not included in released kernels by default. A use-after-free is a class of memory-safety bug where code keeps using memory after it has been released; those can sometimes become exploitable depending on conditions.

The same announcement says the open pull-ups will be committed to the stable branch shortly after the 11.0 release and become part of the upcoming 11.1 release, with a target to release 11.1 within roughly the next couple of months.

This transparency is a reminder that “released” doesn’t mean “everything is closed.” It means the project hit a quality bar they’re willing to stand behind, while still tracking remaining risk.

Features to be removed: groff and pf

Two additional installer-document nuggets help set expectations:

• groff(1): the documentation says man pages are handled with mandoc(1), and groff remains available via pkgsrc.
• pf(4): the installation notes describe pf as obsolete and unmaintained, with plans to remove it due to security concerns and missing multiprocessor support. They explicitly tell new installations to use npf(7).

These warnings are the kind that save you later. If you’re setting up a firewall today, choosing the currently supported framework reduces future migration pain.

Conclusion: the release is more than a version number

NetBSD 11.0 feels like a “systems release” rather than a “marketing release.” The project’s careful installation media split, filesystem capability choices (extended attributes and ACLs), and the transparent list of open security pull-ups all point to a release process that’s optimized for real-world operations, not just correctness in the abstract.

And once you understand the vocabulary—kernel, userland, ports, POSIX compliance, compatibility layers, and pull-up security workflows—the release becomes less intimidating. It becomes a map. Not of features that might show up someday, but of choices you can make today: what media to write, what filesystem capabilities to enable, and which networking and firewall paths are meant to be the long-term ones.