OpenBSD: syspatch, pkg_add -u and upgrades

Updated November 2026

On a supported OpenBSD release, run syspatch to install binary fixes for the base system, pkg_add -u for packages and fw_update for firmware, then reboot if a kernel patch was applied. Only the two most recent releases, 8.0 and 7.9, get fixes.

Supported releases

OpenBSD does not publish fixed end-of-life dates. Security and reliability fixes are backported to the two most recent releases only, as errata. When a new release comes out, the oldest of the two drops off. The errata pages say each release's -stable branch is maintained for one year after release.

Supported OpenBSD releases (as of November 2026)
Release	Released	Support ends
8.0	October 20, 2026	When 8.2 ships (about one year after release)
7.9	May 19, 2026	When 8.1 ships (about one year after release)

OpenBSD 7.8 (released October 22, 2025) stopped receiving errata when 8.0 came out. Note one more limit: security fixes for third-party packages are normally backported only to the most recent release, so on 7.9 your base system is covered but your packages may not be.

Check your release

uname -r
syspatch -l

uname -r prints the release, for example 8.0. syspatch -l lists the binary patches already installed. syspatch is designed to work only on official releases, not on snapshots.

Apply security updates now

Run these as root (or with doas). First, see which patches are waiting:

syspatch -c

Then install all of them, update firmware and update packages:

syspatch
fw_update
pkg_add -u

syspatch downloads, verifies with signify and installs every missing binary patch for the base system. Patches are cumulative, so you cannot pick a subset. Before replacing files it saves a rollback tarball, and syspatch -r reverts the most recent patch. Exit status 2 means no new patch was installed. Full binary patches are built for amd64, i386 and arm64; other architectures get only the rare machine-independent ones.
fw_update installs or updates non-free firmware that cannot ship with OpenBSD, based on the devices found in dmesg. Run it after patching and after every upgrade.
pkg_add -u updates all installed packages and their dependencies. For a release, pkg_add also searches the packages-stable directory, where updated packages for a release are published.

Other architectures and source builds

On architectures without binary patches, either apply the signed source patch from the errata page or follow the -stable branch with CVS and rebuild the kernel and userland. Each patch file starts with exact instructions, for example "rebuild and install a new kernel" for a kernel fix. The full steps are on the -stable page.

Reboot or restart?

OpenBSD has no live kernel patching. Check what each erratum touched on the errata page for your release:

Kernel (network stack, drivers, system calls, ioctl): reboot. This restarts the machine:
```
reboot
```
A daemon such as smtpd, nsd, iked or sshd: restart that service. This briefly interrupts it:
```
rcctl restart smtpd
```
A shared library such as libexpat or libssl: restart every program that uses it, or simply reboot.

When several errata of different kinds land at once, a reboot is the simplest way to be sure everything runs the fixed code. Also restart any service that a pkg_add -u run updated.

Automatic checks

syspatch -c is designed for cron: it prints the available patches and nothing else. A root crontab line such as the one below emails root whenever patches are waiting (cron mails any output):

0 6 * * * /usr/sbin/syspatch -c

Whether you also install automatically is your choice; keep reboots planned. For packages, follow the ports-changes mailing list or run pkg_add -u on a schedule.

Where errata are published

Errata pages: one per release, openbsd.org/errata80.html and openbsd.org/errata79.html, with an index at openbsd.org/errata.html. Each entry is numbered (for example 8.0 errata 003), marked SECURITY FIX or RELIABILITY FIX, dated, shows the affected architectures and links a signed source patch.
Mailing list: details of new errata are sent to announce@openbsd.org, the moderated list for announcements and security advisories. Subscription details are on openbsd.org/mail.html.
Packages: follow the ports-changes mailing list to hear about package updates.

As an example of a typical month: on October 20, 2026, the release day of 8.0, four errata were published for it at once, three of them security fixes, including an IPsec AES-GMAC kernel heap overflow on amd64 and octeon. Erratum 005 on October 23 added the dbupdate utility for refreshing /etc/ssl/cert.pem and the time zone files. See Security advisories for how to triage entries like these.

Upgrade with sysupgrade

New releases have come out about every six months (7.8 in October 2025, 7.9 in May 2026, 8.0 in October 2026), and each one moves the support window, so upgrading is part of patching on OpenBSD. Upgrades are supported only from one release to the next (7.9 to 8.0, not 7.8 to 8.0). Read the upgrade guide for the target release first, for example the 7.9 to 8.0 guide, and check that /usr has at least 1.1 GB.

As root:

sysupgrade

This reboots the system. sysupgrade downloads the install sets to /home/_sysupgrade, verifies them with signify, installs the upgrade kernel as /bsd.upgrade and reboots into an unattended upgrade. Use sysupgrade -n to download and prepare without rebooting, then reboot in your maintenance window. After the system comes back:

sysmerge
fw_update
pkg_add -u
syspatch

sysmerge handles configuration changes that could not be merged automatically at boot. The upgrade guide also lists files to remove and configuration changes to plan for. Finish with syspatch to pick up errata already published for the new release.

On an end-of-life release

A release older than the two supported ones gets no errata, no syspatch patches and no package fixes. If you are one release behind (7.8 today), upgrade to 7.9 and then to 8.0, one step at a time, following each upgrade guide. If you are several releases behind, consider a fresh install of 8.0 with your configuration and data restored from backup instead of a long chain of upgrades. See Is my OS supported? for planning. OpenBSD lists companies offering commercial support on its website if you need outside help.