NetBSD security updates: sysupgrade and pkgsrc

Updated November 2026

NetBSD has no binary patch tool like freebsd-update or syspatch. You fix the base system by moving to a newer build of your release branch (with sysupgrade or sysinst, or by rebuilding from source), and you fix third-party software with pkgin upgrade after checking it with pkg_admin audit.

Supported releases

NetBSD lists its supported releases on its releases page but does not publish end-of-life dates. Anything older than the listed releases gets no bug fixes, including security fixes.

Supported NetBSD releases (as of November 2026)
Series	Supported release	Released	Branch	End of life
11.x	11.0	July 30, 2026	netbsd-11	No date published
10.x	10.2	September 15, 2026	netbsd-10	No date published

NetBSD 9.x is no longer on the supported list. Within a series, only the latest point release is listed: on 10.0 or 10.1 you should move to 10.2. Fixes made on a branch go into the next point release of that series, so changes to 11.0 will appear in 11.1.

Check your release

uname -r
sysctl kern.version

uname -r prints the release, for example 10.2. sysctl kern.version also shows when the running kernel was built, which helps you tell a release kernel from a newer branch build.

How base system fixes reach you

When the security team fixes a problem, the fix is committed to NetBSD-current and pulled up to the supported branches (netbsd-11 and netbsd-10) as fast as possible. You then have three ways to get it:

Binary sets from a daily branch build. NetBSD publishes daily builds of each branch at nycdn.NetBSD.org/pub/NetBSD-daily/ (directories netbsd-11, netbsd-10). Advisories explain how to take the fixed files from a build dated after the fix.
Rebuild from source. Update your source tree from the branch and rebuild the affected parts. Each advisory gives the exact files and commands.
Wait for the next point release. Simple, but slow; use it only for low-risk issues.

For example, the advisory for the OpenSSH "regreSSHion" bug (NetBSD-SA2024-002) listed a config workaround, the files to extract from a fixed daily base set, and source rebuild steps for each branch, then said to restart sshd.

Update the base system with sysupgrade

sysupgrade is not in the base system; it is a package (pkgsrc sysutils/sysupgrade). It fetches a kernel and sets, unpacks them and helps you merge configuration changes. Install it once, as root:

pkgin install sysupgrade

To move to a release within the same series (for example 10.1 to 10.2 on amd64), as root:

sysupgrade auto https://cdn.NetBSD.org/pub/NetBSD/NetBSD-10.2/amd64
reboot

The last line reboots the machine into the new kernel. To pick up fixes made after the latest point release, you can point sysupgrade at a daily build of your branch instead, such as https://nycdn.NetBSD.org/pub/NetBSD-daily/netbsd-10/latest/amd64. Branch builds get the fixes first but have had less testing than a release, so try them on one machine before the rest. Settings live in /usr/pkg/etc/sysupgrade.conf.

Major upgrades (10.x to 11.0)

Your running kernel must never be older than the userland. Upgrade the kernel and modules first, reboot, then the rest. As root:

sysupgrade fetch https://cdn.NetBSD.org/pub/NetBSD/NetBSD-11.0/amd64
sysupgrade kernel
sysupgrade modules
reboot
sysupgrade sets
sysupgrade etcupdate
sysupgrade postinstall
sysupgrade clean
reboot

Both reboot lines restart the machine. Read the release announcement first: NetBSD 11.0 adds new sets that you may need to install with sysinst. Afterwards, point your package repository at the 11.0 packages and update every package.

Using sysinst instead

You can also boot an installation image of the new release and choose "Upgrade NetBSD on a hard disk" in sysinst. It replaces the binaries, runs postinstall, and you then use etcupdate to merge other configuration changes. This needs console access, so sysupgrade is usually faster on remote servers.

Update and audit packages

Third-party software comes from pkgsrc. pkgin is the usual front end for binary packages. As root:

pkg_admin fetch-pkg-vulnerabilities
pkg_admin audit
pkgin update
pkgin upgrade

pkg_admin fetch-pkg-vulnerabilities downloads the signed list of known vulnerabilities in pkgsrc packages, kept by the pkgsrc Security Team.
pkg_admin audit checks every installed package against that list and prints a line with a link for each problem, for example "Package wireshark-2.0.1 has a denial-of-service vulnerability, see …".
pkgin update refreshes the list of available packages; pkgin upgrade upgrades all packages to the newest versions in the repository.

pkgsrc is released in quarterly branches. When you move to a newer quarterly branch or a new NetBSD release, edit /usr/pkg/etc/pkgin/repositories.conf to point at the new repository first. Restart any service whose package was upgraded, for example service nginx restart (this briefly interrupts it).

Automatic checks

NetBSD's daily maintenance scripts can fetch the vulnerability list and audit packages for you, and the results arrive in root's daily mail. Add this line to /etc/daily.conf:

fetch_pkg_vulnerabilities=YES

The package audit in the daily security script is on by default. To set it explicitly, add check_pkg_vulnerabilities=YES to /etc/security.conf. Make sure root's mail is read by a person or forwarded. There is no automatic installer for base system fixes; subscribe to the announcement lists below and act on them.

Reboot or restart?

NetBSD has no live kernel patching. If the kernel or kernel modules changed, reboot. If a fix touched only a program or library, restart the services that use it, as the advisory tells you; for the OpenSSH fix, that was service sshd restart. After a sysupgrade run, always reboot.

Where advisories are published

Security page and advisory archive: netbsd.org/support/security/, with the full list at netbsd.org/support/security/advisory.html. Advisories are named NetBSD-SAYYYY-NNN and are PGP-signed.
RSS: rss-advisories.xml.
Mailing lists: netbsd-announce and security-announce carry advisories; tech-security is for discussion.
pkgsrc: the vulnerability list read by pkg_admin audit, at cdn.NetBSD.org/pub/NetBSD/packages/vulns/pkg-vulnerabilities.

Formal advisories are rare: as of November 2026 the newest one listed is NetBSD-SA2024-002 from July 2024. The security team may also hold back an advisory to cover several issues at once. Many fixes therefore reach you only through branch updates and point releases, which is why staying on the latest point release, or a recent branch build, matters. See Security advisories for following several vendors at once.

On an end-of-life release

If you still run NetBSD 9.x or older, you get no fixes at all. Upgrade to 10.2 or 11.0 using the major upgrade steps above, one major version at a time, and take a full backup first. Then update all packages from the matching pkgsrc repository. More on planning in Is my OS supported?.