NetBSD 9.5 ships as the final 9.x release as the 2020 branch reaches end of support

The NetBSD project has released NetBSD 9.5, the fifth and final version of the 9.x series launched in February 2020. The release closes out the branch with security and stability fixes — including a remotely triggerable flaw in the ipf(8) packet filter, a kernel-stack information leak in the TCP stack and a ZFS data-corruption bug — as well as updated X.Org, OpenSSL and OpenSSH components. With 9.5, maintenance of all NetBSD 9 releases ends; the project recommends production users move to NetBSD 10 or 11.

Key Takeaways

The NetBSD project has released NetBSD 9.5, the fifth and final version of the 9.x series launched in February 2020.
The release closes out the branch with security and stability fixes — including a remotely triggerable flaw in the ipf(8) packet filter, a kernel-stack information leak in the TCP stack and a ZFS data-corruption bug — as well as updated X.Org, OpenSSL and OpenSSH components.
With 9.5, maintenance of all NetBSD 9 releases ends; the project recommends production users move to NetBSD 10 or 11.

AI synthesis4 sources11

With NetBSD 9.5, maintenance of the entire NetBSD 9 branch comes to an end. The fifth and final release of the series — which has been maintained since February 2020 and was published at the end of August — brings above all security and stability fixes, and few new features. NetBSD 9.5 remains fully compatible with NetBSD 9.0, so the update is comparatively unspectacular for existing installations.

The most important corrections: in the ipf(8) packet filter, NetBSD closes a remotely triggerable null-pointer dereference while processing ICMPv6 packets. In the TCP stack, developers fix a four-byte information leak from the kernel stack via TCP timestamps and add protection against the TCP SegmentSmack denial-of-service attack. NetBSD also stops wrongly discarding fragmented IPv6 packets with a length of 32 bytes and fixes possible data corruption in ZFS involving FIOSEEKDATA and FIOSEEKHOLE.

Further fixes cover the BPF packet filter (including deadlocks and multiprocessor safety issues), the hdaudio(4) audio driver, the fsck_ffs(8) filesystem checker, which could crash on filesystems with more than 2^32 blocks, and several memory leaks in the syslogd(8) daemon.

On the hardware side, NetBSD 9.5 fixes an error in thread-local-storage support on AArch64 and the configuration of MSI and MSI-X on some x86 systems. The uftdi(4) driver now supports additional Brainboxes USB-serial adapters, and the urtwn(4) Wi-Fi driver adds the Mercusys MW150US v2 and Asus USB-N10 Nano B1 adapters. Improvements for some VIA-IDE controllers and a working ACPI brightness control on certain machines round out the changes.

Bundled third-party components also receive security fixes: X.Org with xorg-server, libXfont2 and libXpm, plus OpenSSL and OpenSSH. For the Unbound DNS resolver, NetBSD adopts an upstream fix for CVE-2025-11411, the timezone database is updated, and xkbcomp ships in version 1.5.0.

That marks the end of a long lifecycle: NetBSD 9.0 appeared on 14 February 2020 and introduced, among other things, support for AArch64 systems and kernel ASLR on 64-bit x86; the series also significantly improved ZFS support. The project recommends that anyone running NetBSD 9.x in production move to NetBSD 10 or 11 — no further security patches are planned for the 9 branch. NetBSD 9.5 is available for download for numerous architectures.