FreeBSD 15.1-RELEASE: What's New

The FreeBSD Project has released version 15.1-RELEASE, the first point update in the 15-STABLE series. This release consolidates security fixes accumulated since 15.0, and also brings relevant improvements in ZFS, virtualization, networking and hardware support — points of direct interest for those operating hybrid infrastructure with Proxmox, storage and complex networks.

Below is a summary of the technical highlights based on the official release notes.

Security and Errata

Since 15.0-RELEASE, the project has published 28 security advisories (SA) and 16 errata notices (EN). Worth highlighting some of the most impactful:

• FreeBSD-SA-26:13.exec — local privilege escalation via execve().

• FreeBSD-SA-26:09.pf / 26:14.pf — pf silently ignoring certain rules, and stack overflow when processing malformed SCTP packets.

• FreeBSD-SA-26:12.dhclient / 26:15.dhclient — remote code execution and heap overflow via malicious DHCP options.

• FreeBSD-SA-26:08.rpcsec_gss — remote code execution via RPCSEC_GSS packet validation.

• FreeBSD-SA-26:23.bsdinstall — RCE via Wi-Fi access point scans during installation.

• FreeBSD-SA-26:18.setcred — stack buffer overflow via setcred(2).

• FreeBSD-SA-26:30.linux — Linuxulator flaw when executing setugid binaries.

Among the errata, highlights include fixes in the page fault handler (incorrect memory zeroing — fixed twice, in January and April 2026), a TLB invalidation bug on AMD systems with INVLPGB, and OpenSSL updated to versions 3.0.20 and 3.5.6.

Practical recommendation: before planning a production upgrade, it is worth reviewing the official errata document — it covers problems discovered late in the release cycle.

Userland

Changes in packaging (pkgbase)

For those using package-based installation of the base system:

• OpenPAM migrated to its own package, FreeBSD-pam. Systems with minimal sets install automatically; others need to install manually to keep PAM authentication working (e.g., login, sshd).

• Zstandard (including the zstd utility) also became a separate package, FreeBSD-zstd.

• The installworld and installkernel targets are now blocked on systems installed via packages, to avoid inconsistency in the package database. Those upgrading via source need to first deregister the base packages (freebsd-base(7)).

Default configuration and shell

The default shell for the root user and the freebsd user in release images changed from csh to sh. This is relevant for provisioning scripts that assume csh as default.

Utilities

Some changes that directly affect sysadmin routine:

• find(1) gained the -xattr and -xattrname predicates, allowing to search files by extended attributes (including by namespace, such as user: or system:).

• pwd(1) now uses -L (logical) by default, following POSIX — paths with . or .. components are rejected in logical mode.

• bectl(8) gained the -E flag to create an empty boot environment, without cloning the running environment.

• newfs(8) now prevents simultaneous use of GEOM journaling and soft updates, and gained the -u flag to disable soft updates/journaling on UFS2.

• zfs clone gained the -u option, avoiding automatic mounting of newly cloned datasets — useful in scripts.

• cron(8) now implements the full PAM session cycle for user jobs.

Third-party software (contrib)

Relevant version updates:

Unicode 17.0.0 support adds 4,803 characters and 4 new scripts.

Deprecations

• The lpr utility set (lpr, lpd, lpc, lpq, lprm, pac, etc.) has been deprecated and may be removed in FreeBSD 16.0. Recommended alternatives: print/cups or sysutils/LPRng.

• bsdlabel(8) and fdisk(8) are scheduled for removal in 16.0 — migration recommended to gpart(8).

Cloud

For cloud environments, some relevant points:

• Oracle Cloud Infrastructure (OCI) images are no longer built; the last official images are from 15.0-RELEASE.

• The pkg(7) package is now pre-installed on VM/cloud images with packaged base system, eliminating manual installation.

• On EC2 Graviton (arm64) instances, I/O interrupts from the ena(4) driver are now distributed among CPUs instead of concentrated on CPU 0 — significant network performance gain.

• Cloud images now include an automatic package updater on first boot.

• Attention for those using EC2 "small" AMIs: firstboot_pkgs no longer runs by default; if you use firstboot_pkgs_list, it is also necessary to set firstboot_pkgs_enable="YES".

Kernel

• New scheduler selection framework at boot time via tunable. The amd64 GENERIC configuration now includes both SCHED_ULE and SCHED_4BSD, selectable via sysctl kern.sched.

• The MINIMAL configuration now includes the virtio_scsi driver, allowing boot on QEMU/KVM VMs.

• New syscalls: pdwait(2) (wait on process descriptors) and pdrfork(2) (process creation with deterministic resource inheritance).

• Legacy ZFS sysctls (such as vfs.zfs.min_auto_ashift) now emit deprecation warnings — the replacement is vfs.zfs.vdev.min_auto_ashift. It is worth reviewing automation scripts that depend on old names.

Storage and ZFS

For environments with heavy storage loads, this release brings specific gains:

• ZFS scrub and resilver minimum times were reduced from multi-second values to sub-second, allowing faster transaction group cycles on modern storage — direct improvement in write performance under heavy load.

• New tunable zfs_arc_evict_batches_limit, which reduces lock contention and can significantly increase ARC eviction throughput under certain loads.

• zpool prefetch now supports BRT (Block Reference Table) metadata, improving performance in block cloning operations.

• zdb(8) gained the -O option to copy files directly by object ID.

NFS

• NFS client now correctly handles case-insensitive filesystems (such as msdosfs) when exported via NFS, avoiding false cache hits.

• Diskless boot via NFSv4 now supports nfsuserd(8) for name/ID mapping, with specific requirements in loader.conf.

• Experimental support for draft POSIX ACLs as an extension to NFSv4.2 (no visible changes yet, but requires recompilation of nfscommon.ko, nfscl.ko and nfsd.ko after the update).

• iSCSI: TargetName matching at login is again case-insensitive, restoring compliance with RFC 3722.

Networking

• ipfw(8) gained support for masked IP lookups in tables, allowing non-contiguous prefixes and more CPU-efficient firewall rules.

• divert sockets now accept IPv6 packets, eliminating the old IPv4 limitation.

• Support for stable IPv6 address generation according to RFC 7217, via new stableaddr flag of ifconfig (disabled by default).

⚠️ Attention when upgrading bridge/epair: the stable MAC address generated for if_bridge(4), if_epair(4) and similar interfaces changes since 15.0 due to a critical flaw in the previous implementation that caused collisions. If you depend on the previous MAC (for example, for DHCP leases), it is necessary to manually set it via ifconfig_bridgeN="… ether aa:bb:cc:dd:ee:ff" in rc.conf.

Virtualization

For environments running bhyve or jails with passthrough:

• New jail knob allow.vmm_ppt to control access to PCI passthrough in bhyve(8) jails — now requires explicit configuration, replacing the previous generic restriction.

• Support for UNIX domain socket in bhyve remote framebuffer, enabling graphical console for bhyve instances in jails without network.

• amd64 gained support for LASS (Linear Address Space Separation), a security feature that isolates kernel/user address spaces.

• Support for Extended Destination ID, enabling up to 32,768 APIC IDs without interrupt remapping — relevant for large EC2 instances such as r8i.96xlarge.

Devices and drivers

• ena(4) (network driver for EC2) updated to v2.8.3, with a fix in the jumbogram receive path that can result in 10x or more network throughput gain.

• ice(4) gained support for Intel E835 adapters, including SPDM security and RDMA capabilities on 100/200 Gbps links.

• smartpqi updated, with support for new controllers and increased I/O buffer limit in passthrough ioctls (from 16 to 32 bits).

• iwx(4) is now part of the default kernel build configuration, bringing Wi-Fi 6E/7 support (Intel AX210/AX211/AX411).

Deprecated/removed drivers

• hifn(4) and safe(4) scheduled for removal in 16.0.

• agp(4) and fdc(4) (and floppy utilities) also scheduled for removal in 16.0 — the date was postponed relative to previous planning.

Upgrade considerations

Before planning a production migration to 15.1-RELEASE, it is worth reviewing especially:

1. Legacy ZFS sysctls and configurations — if there is automation depending on old names (vfs.zfs.min_auto_ashift), update before they are removed.

2. MAC addresses of bridges/epair — if there is dependency on fixed MAC (DHCP, switch ACLs), handle it explicitly in rc.conf before the upgrade.

3. Separate pkgbase packages (PAM, Zstandard) — confirm that the correct packages are installed if the system does not use the minimal sets.

4. Recompiled NFS modules — after updating, nfscommon.ko, nfscl.ko and nfsd.ko need to be rebuilt from source due to internal KAPI changes.

5. Accumulated errata and security advisories — with 28 SAs since 15.0, it is worth reviewing which have already been mitigated in current environments before a direct upgrade.

Source

Content based on the official FreeBSD 15.1-RELEASE Release Notes, published by The FreeBSD Project.