FreeBSD security updates: freebsd-update, pkg and pkgbase

Updated November 2026

On a FreeBSD release installed from distribution sets, run freebsd-update fetch install for the base system and pkg upgrade for third-party software, then reboot if the kernel changed. On a system installed from base packages (pkgbase, FreeBSD 15.0 and later), use pkg upgrade -r FreeBSD-base instead.

Supported releases

The FreeBSD Security Officer supports each release for a limited time. The table shows the official list as of November 2026. The dates are the earliest day support can end; the project says they may be pushed back.

Supported FreeBSD branches and releases (as of November 2026)
Branch	Release	Released	Expected end of life
stable/15	–	–	December 31, 2029
releng/15.1	15.1-RELEASE	June 16, 2026	March 31, 2027
stable/14	–	–	November 30, 2028
releng/14.5	14.5-RELEASE	September 8, 2026	June 30, 2027
releng/14.4	14.4-RELEASE	March 10, 2026	December 31, 2026

FreeBSD 15.0 reached end of life on September 30, 2026, and 14.3 on June 30, 2026. The rule behind the dates: a minor release is supported for three months after the next minor release on the same branch. From FreeBSD 15 on, each stable branch is supported for four years from its .0 release.

14.4 ends soon. If you run 14.4, plan the move to 14.5 or 15.1 before December 31, 2026. After that date, 14.4 gets no security fixes.

Check your release and patch level

freebsd-version -kru
uname -r

freebsd-version -k shows the installed kernel, -r the running kernel and -u the userland, for example 15.1-RELEASE-p4. The -p number is the patch level. To check a jail, add -j jailname.

Next, find out how the base system was installed, because this decides which update tool you use:

pkg info -g 'FreeBSD-*'

Base system packages all have names starting with FreeBSD-. If this lists packages such as FreeBSD-runtime, the system uses pkgbase. If it lists nothing (or pkg is not installed yet), the system was installed from distribution sets and you use freebsd-update.

Do not mix methods. Use either freebsd-update or pkg for the base system on a given host or jail, never both.

Apply security updates now

Systems installed from distribution sets

As root:

freebsd-update fetch
freebsd-update install

fetch downloads and lists the changed files; install applies them. Binary updates are built only for RELEASE versions (not -STABLE or -CURRENT); recent advisories describe them for amd64 and arm64. Only the GENERIC kernel is updated. If you run a custom kernel, rebuild and install it after the update. If an update breaks something, freebsd-update rollback removes the last set of changes.

Systems installed from base packages (pkgbase)

As root:

pkg upgrade -r FreeBSD-base

This updates only the base system packages from the FreeBSD-base repository. Current FreeBSD Security Advisories give this command for 15.0 and later systems installed from base packages on amd64 and arm64.

Third-party packages

Software from the ports collection (nginx, PHP, databases and so on) is not covered by freebsd-update. Check and update it separately, as root:

pkg audit -F
pkg upgrade

pkg audit -F downloads the current vulnerability database (VuXML, kept by port committers and the security team) and lists installed packages with known issues. Add -r to also show packages that depend on a vulnerable one. Run pkg upgrade -n first if you want a dry run.

Reboot or restart?

Compare the installed and running kernel:

freebsd-version -k
uname -r

If the two differ, a new kernel is installed but not running. Reboot (this restarts the machine):

shutdown -r now

FreeBSD advisories usually show shutdown -r +10min "Rebooting for a security update", which gives logged-in users a warning. If only userland was patched, you can often restart the affected daemons instead. Section V ("Solution") of each advisory says what to restart, for example "Restart all daemons that use the library, or reboot the system" for an OpenSSL fix. Restart a service with service sshd restart (this briefly interrupts it).

FreeBSD has no live kernel patching. Kernel fixes take effect only after a reboot, so plan a maintenance window for kernel advisories.

Automatic checks

freebsd-update can check daily and email root, without installing anything. Add this line to /etc/crontab:

@daily root freebsd-update cron

The cron command waits a random time of up to an hour, downloads any updates and mails root. You still run freebsd-update install yourself. Do not put freebsd-update fetch in cron; the manual page asks you to use cron instead. For packages, run pkg audit -F daily from cron or your monitoring system and alert on any output.

Jails

Update jails from the host. A jail runs the host's kernel, so only the host needs a reboot for kernel fixes. For a jail installed from distribution sets, as root on the host:

freebsd-update -j myjail fetch install
service jail restart myjail

The second line restarts the jail and its services. For a jail installed from base packages, use pkg against the jail instead:

jexec -l myjail pkg upgrade
service jail restart myjail

Third-party packages inside a jail can be checked from the host with pkg -j myjail audit -F and updated with pkg -j myjail upgrade. On ZFS, snapshot the jail dataset first (zfs snapshot zroot/jails/myjail@prepatch) so you can roll back. NullFS thin jails share a template, so you patch the template once with freebsd-update -b /path/to/template fetch install.

pkgbase in FreeBSD 15

From 15.0, the base system is also published as pkg packages, called base system packages or pkgbase. Key points as of November 2026:

The Handbook calls base packages a technology preview in 15.0. They are expected to become the standard method in later releases.
In 15.1, scripted installs with bsdinstall use base packages by default; distribution sets remain available.
Distribution sets and freebsd-update stay supported for the lifetime of the FreeBSD 15 stable branch. Their removal is planned for FreeBSD 16.
On a pkgbase system, pkg merges configuration files in /etc itself. Look for .pkgnew files after an upgrade, and do not run etcupdate.

Converting an existing host to pkgbase is still described as in development. Test it on a non-production machine before you change a server.

Where advisories are published

Security Advisories (FreeBSD-SA-YY:NN.name) for the base system: freebsd.org/security/advisories/. Each lists affected versions, the fixed patch level per branch (for example 15.1-RELEASE-p4), a workaround if any, and update steps.
Errata Notices (FreeBSD-EN) for important non-security bugs: freebsd.org/security/notices/.
Mailing lists: advisories go to freebsd-security-notifications@FreeBSD.org, freebsd-security@FreeBSD.org and freebsd-announce@FreeBSD.org. Subscribe to the notifications list at minimum.
Ports and packages: covered by VuXML at vuxml.FreeBSD.org, which is what pkg audit reads.

Advisories are signed with the Security Officer PGP key. For a general approach to reading them, see Security advisories.

On an end-of-life release

An unsupported release (such as 15.0 or 14.3 today) gets no new security fixes, so freebsd-update fetch has nothing new to install for it. On a system installed from distribution sets, upgrade to a supported release as root:

freebsd-update -r 15.1-RELEASE upgrade
freebsd-update install
shutdown -r now
freebsd-update install

The shutdown line reboots into the new kernel. Read the release notes first. After a major upgrade (14.x to 15.x) reinstall all packages with pkg-static upgrade -f, then run freebsd-update install once more and reboot. Some upgrades need only two install phases instead of three. On a pkgbase system, follow the Handbook section on upgrading with base packages instead. More on planning this in Is my OS supported?.