---
title: "FreeBSD 14.3-RELEASE Release Notes"
sidenav: download
---

:localRel: 14.3
:releaseCurrent: 14.3-RELEASE
:releaseBranch: 14-STABLE
:releasePrev: 14.2-RELEASE
:releaseNext: X.Y-RELEASE
:releaseType: "release"

include::shared/en/urls.adoc[]

= FreeBSD {releaseCurrent} Release Notes
:doctype: article
:toc: macro
:toclevels: 1
:icons: font

== Abstract

[.abstract-title]
The release notes for FreeBSD {releaseCurrent} contain a summary of the changes made to the FreeBSD base system on the {releaseBranch} development line.
This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland.
Some brief remarks on upgrading are also presented.

[[intro]]
== Introduction

This document contains the release notes for FreeBSD {releaseCurrent}.
It describes recently added, changed, or deleted features of FreeBSD.
It also provides some notes on upgrading from previous versions of FreeBSD.

The {releaseType} distribution to which these release notes apply represents the latest point along the {releaseBranch} development branch since {releaseBranch} was created.
Information regarding pre-built, binary {releaseType} distributions along this branch can be found at https://www.FreeBSD.org/releases/[].

The {releaseType} distribution to which these release notes apply represents a point along the {releaseBranch} development branch between {releasePrev} and the future {releaseNext}.
Information regarding pre-built, binary {releaseType} distributions along this branch can be found at https://www.FreeBSD.org/releases/[].

This distribution of FreeBSD {releaseCurrent} is a {releaseType} distribution.
It can be found at https://www.FreeBSD.org/releases/[] or any of its mirrors.
More information on obtaining this (or other) {releaseType} distributions of FreeBSD can be found in the link:{handbook}/mirrors[Obtaining FreeBSD appendix] to the link:{handbook}/[FreeBSD Handbook].

All users are encouraged to consult the release errata before installing FreeBSD.
The errata document is updated with "late-breaking" information discovered late in the release cycle or after the release.
Typically, it contains information on known bugs, security advisories, and corrections to documentation.
An up-to-date copy of the errata for FreeBSD {releaseCurrent} can be found on the FreeBSD Web site.

This document describes the most user-visible new or changed features in FreeBSD since {releasePrev}.
In general, changes described here are unique to the {releaseBranch} branch unless specifically marked as MERGED features.

Typical release note items document recent security advisories issued after {releasePrev}, new drivers or hardware support, new commands or options, major bug fixes, or contributed software upgrades.
They may also list changes to major ports/packages or release engineering practices.
Clearly the release notes cannot list every single change made to FreeBSD between releases; this document focuses primarily on security advisories, user-visible changes, and major architectural improvements.

[[upgrade]]
== Upgrading from Previous Releases of FreeBSD

Binary upgrades between RELEASE versions (and snapshots of the various security branches) are supported using the man:freebsd-update[8] utility.
See the release-specific upgrade procedure, link:../installation/#upgrade-binary[FreeBSD {releaseCurrent} upgrade information], with more details in the FreeBSD handbook link:{handbook}cutting-edge/#freebsdupdate-upgrade[binary upgrade procedure].
This will update unmodified userland utilities, as well as unmodified GENERIC kernels distributed as a part of an official FreeBSD release.
The man:freebsd-update[8] utility requires that the host being upgraded have Internet connectivity.

Source-based upgrades (those based on recompiling the FreeBSD base system from source code) from previous versions are supported, according to the instructions in [.filename]#/usr/src/UPDATING#.

[IMPORTANT]
====
Upgrading FreeBSD should only be attempted after backing up _all_ data and configuration files.
====

[[security-errata]]
== Security and Errata

This section lists the various Security Advisories and Errata Notices since {releasePrev}.

[[security]]
=== Security Advisories

[.informaltable]
[cols="1,1,1", frame="none", options="header"]
|===
| Advisory
| Date
| Topic

| https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc[FreeBSD-SA-25:01.openssh]
| 2025-01-29
| OpenSSH Keystroke Obfuscation Bypass

| https://www.freebsd.org/security/advisories/FreeBSD-SA-25:02.fs.asc[FreeBSD-SA-25:02.fs]
| 2025-01-29
| Buffer overflow in some filesystems via NFS

| https://www.freebsd.org/security/advisories/FreeBSD-SA-25:03.etcupdate.asc[FreeBSD-SA-25:03.etcupdate]
| 2025-01-29
| Unprivileged access to system files

| https://www.freebsd.org/security/advisories/FreeBSD-SA-25:04.ktrace.asc[FreeBSD-SA-25:04.ktrace]
| 2025-01-29
| Uninitialized kernel memory disclosure via man:ktrace[2]

| https://www.freebsd.org/security/advisories/FreeBSD-SA-25:05.openssh.asc[FreeBSD-SA-25:05.openssh]
| 2025-02-21
| Multiple vulnerabilities in OpenSSH
|===

[[errata]]
=== Errata Notices

[.informaltable]
[cols="1,1,1", frame="none", options="header"]
|===
| Errata
| Date
| Topic

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:01.rpc.asc[FreeBSD-EN-25:01.rpc]
| 2025-01-29
| NULL pointer dereference in the NFSv4 client

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:02.audit.asc[FreeBSD-EN-25:02.audit]
| 2025-01-29
| System call auditing disabled by DTrace

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:03.tzdata.asc[FreeBSD-EN-25:03.tzdata]
| 2025-01-29
| Timezone database information update

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:04.tzdata.asc[FreeBSD-EN-25:04.tzdata]
| 2025-04-10
| Timezone database information update

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:05.expat.asc[FreeBSD-EN-25:05.expat]
| 2025-04-10
| Update expat to 2.7.1

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:06.daemon.asc[FreeBSD-EN-25:06.daemon]
| 2025-04-10
| man:daemon[8] missing signals

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:07.openssl.asc[FreeBSD-EN-25:07.openssl]
| 2025-04-10
| Update OpenSSL to 3.0.16

| https://www.freebsd.org/security/advisories/FreeBSD-EN-25:08.caroot.asc[FreeBSD-EN-25:08.caroot]
| 2025-04-10
| Root certificate bundle update
|===

[[userland]]
== Userland

This section covers changes and additions to userland applications, contributed software, and system utilities.

[[userland-config]]
=== Userland Configuration Changes

[[userland-programs]]
=== Userland Application Changes

Fix `-U` flag of man:ps[1] to select processes by real user IDs.
This is what POSIX mandates for option `-U` and arguably the behavior that most users actually need in most cases.
Before, `-U` would select processes by their effective user IDs (which is the behavior mandated by POSIX for option `-u`).
gitref:a2132d91739d[repository=src].
(Sponsored by The FreeBSD Foundation).

Make '-O' more versatile and predictable for man:ps[1].
The man:ps[1] display's list of columns is now first built without taking into account the `-O` options.
In a second step, all columns passed via `-O` are finally inserted after the built-so-far display's first PID column (if it exists, else at start), in their order of appearance as arguments to the `-O` options.
gitref:1fc8cb547cd4[repository=src].
(Sponsored by The FreeBSD Foundation).

Add flags to filter jail prison and vnet variables in man:sysctl[8] output.
So users do not have to contact the source code to tell whether a variable is a jail prison / vnet one or not.
gitref:615c9ce250ee[repository=src].

LinuxKPI: Make `linux_alloc_pages()` honor `__GFP_NORETRY`.
This is to fix slowdowns with drm-kmod that get worse over time as physical memory become more fragmented (and probably also depending on other factors).
gitref:831e6fb0baf6[repository=src]
(Sponsored by The FreeBSD Foundation).

man:grep[1] no longer follows symbolic links by default for recursive searches.
This matches the documented behavior in the manual page.
gitref:3a2ec5957ea9[repository=src]

[[userland-contrib]]
=== Contributed Software

`tzdata` has been consecutively updated to 2025a(gitref:a158d26e89f2[repository=src]) and 2025b(gitref:475082194ac8[repository=src]).

[[userland-deprecated-programs]]
=== Deprecated Applications

[[userland-libraries]]
=== Runtime Libraries and API

[[kernel]]
== Kernel

This section covers changes to kernel configurations, system tuning, and system control parameters that are not otherwise categorized.

Teach man:sysctl[8] to attach and run itself in a jail.
This allows the parent jail to retrieve or set kernel state when child does not have man:sysctl[8] installed (for example light weighted OCI containers or slim jails).
This is especially useful when manipulating jail prison or vnet sysctls.
For example, `sysctl -j foo -Ja` or `sysctl -j foo net.fibs=2`.
gitref:8d5d7e2ba3a6[repository=src].

[[kernel-general]]
=== General Kernel Changes

Support PCIe hotplug on arm64.
gitref:355f02cddbf0[repository=src].
(Sponsored by Arm Ltd).

Define a common 'mac' node for MAC's jail parameters for man:mac[3].
To be used by man:mac_do[4].
gitref:66fb52a27279[repository=src].
(Sponsored by The FreeBSD Foundation).

New `setcred()` system call and associated MAC hooks.
This new system call allows to set all necessary credentials of a process in one go: Effective, real and saved UIDs, effective, real and saved GIDs, supplementary groups and the MAC label.
Its advantage over standard credential-setting system calls (such as `setuid()`, `seteuid()`, etc.) is that it enables MAC modules, such as man:mac_do[4], to restrict the set of credentials some process may gain in a fine-grained manner.
gitref:c1d7552dddb5[repository=src].
(Sponsored by The FreeBSD Foundation).

Support multiple users and groups as single rule's targets in man:mac_do[4].
Supporting group targets is a requirement for man:mac_do[4] to be able to enforce a limited set of valid new groups passed to `setgroups()`.
Additionally, it must be possible for this set of groups to also depend on the target UID, since users and groups are quite tied in UNIX (users are automatically placed in only the groups specified through '/etc/passwd' (primary group) and '/etc/group' (supplementary ones)).
gitref:83ffc412b2e9[repository=src].
(Sponsored by The FreeBSD Foundation).

[[drivers]]
== Devices and Drivers

This section covers changes and additions to devices and device drivers since {releasePrev}.

[[drivers-device]]
=== Device Drivers

man:sound[4]: Allocate vchans on-demand.
Refactor `pcm_chnalloc()` and merge with parts of `vchan_setnew()` (now removed) and `dsp_open()`’s channel creation into a `new dsp_chn_alloc()` function.
The function is responsible for either using a free HW channel (if `vchans` are disabled), or allocating a new vchan.
`hw.snd.vchans_enable` (previously `hw.snd.maxautovchans`) and `dev.pcm.X.{play|rec}.vchans` now work as tunables to only enable/disable `vchans`, as opposed to setting their number and/or (de-)allocating vchans.
Since these sysctls do not trigger any (de-)allocations anymore, their effect is instantaneous, whereas before it could have frozen the machine (when trying to allocate new vchans) when setting `dev.pcm.X.{play|rec}.vchans` to a very large value.
gitref:960ee8094913[repository=src].
(Sponsored by	The FreeBSD Foundation).

[[drivers-removals]]
=== Deprecated and Removed Drivers

[[storage]]
== Storage

This section covers changes and additions to file systems and other storage subsystems, both local and networked.

[[storage-general]]
=== General Storage

Define a new `-a` command line option man:mountd[8].
When a file system was exported with the `-alldirs` flag, the export succeeded even if the directory path was not a server file system mount point.
gitref:ead3cd3ef628[repository=src]

Document recent file handle layout changes.
gitref:ca22082c01a7[repository=src]

Allow to pass `{NGROUPS_MAX} + 1` groups in man:mountd[8].
`NGROUPS_MAX` is just the minimum maximum of the number of allowed supplementary groups.
The actual runtime value may be greater.
Allow more groups to be specified accordingly (now that, a few commits ago, man:nmount[2] has been changed similarly).
gitref:ca9614d8f64a[repository=src]
(Sponsored by The FreeBSD Foundation).

== Boot Loader Changes

This section covers the boot loader, boot menu, and other boot-related changes.

man:loader.efi[8]: Favor the v3 (64-bit) entry point in man:smbios[4].
Be consistent with what is done with non-EFI boot (but with the difference that EFI runs in 64-bit mode on 64-bit platforms, so there is no restriction that the v3 entry point should be below 4GB).
gitref:807d51be8040[repository=src].
(Sponsored by The FreeBSD Foundation).

man:libsa[3]: Favor the v3 (64-bit) entry point on non-EFI boot in man:smbios[4].
When both the 32-bit and 64-bit entry points are present, the SMBIOS specification says that the 64-bit entry point always has at least all the structures the 32-bit entry point refers.
In other words, the 32-bit entry point is provided for compatibility, so it is assumed the 64-bit one has more chances to be filled with adequate values.
gitref:93af0db0d529[repository=src]
(Sponsored by The FreeBSD Foundation).

man:libsa[3]: Use 64-bit entry point if table below 4GB on non-EFI boot in man:smbios[4].
On amd64, boot blocks and the non-EFI loader are 32-bit compiled as clients of BTX, so cannot access addresses beyond 4GB.
However, the 64-bit entry point may refer to a structure table below 4GB, which can be used if the BIOS does not provide a 32-bit entry point.
The situation is similar for powerpc64.
gitref:7b0350b376c0[repository=src].
(Sponsored by The FreeBSD Foundation).

Search for v3 (64-bit) entry point first on BIOS boot in man:smbios[4].
When booted from BIOS (i.e., not EFI), also search for a 64-bit version of the SMBIOS Entry Point.
This allows to detect and report the proper SMBIOS version with BIOSes that only provide the v3 table, as happens on Hetzner virtual machines.
For machines that provide both, leverage the v3 table in priority consistently with the EFI case.
gitref:145ef4af15f0[repository=src].
(Sponsored by The FreeBSD Foundation).

[[boot-loader]]
=== Boot Loader Changes

[[network]]
== Networking

This section describes changes that affect networking in FreeBSD.

[[network-general]]
=== General Network

man:ix[4]: Add support for 1000BASE-BX SFP modules.
Add support for 1Gbit BiDi modules.
gitref:c34817d9aef7[repository=src].

man:igc[4]: Fix attach for I226-K and LMVP devices.
The device IDs for these were in the driver's list of PCI ids to attach to, but `igc_set_mac_type()` had never been setup to set the correct mac type for these devices.
Fix this by adding these IDs to the switch block in order for them to be recognized by the driver instead of returning an error.
This fixes the man:igc[4] attach for the I226-K LOM on the ASRock Z790 PG-ITX/TB4 motherboard, allowing it to be recognized and used.
gitref:f034ddd2fa38[repository=src].

Teach man:ip6addrctl[8] to attach and run itself in a jail.
This will make it easier to manage address selection policies of vnet jails, especially for those light weighted OCI containers or slim jails.
gitref:b709f7b38cc4[repository=src]

Convert `PF_DEFAULT_TO_DROP` into a vnet loader tunable 'net.pf.default_to_drop' for man:pf[4].
gitref:7f7ef494f11d[repository=src] introduced a compile time option `PF_DEFAULT_TO_DROP` to make the man:pf[4] default rule to drop.
While this change exposes a vnet loader tunable 'net.pf.default_to_drop' so that users can change the default rule without re-compiling the man:pf[4] module.
gitref:3965be101c43[repository=src]

Remove old itr sysctl handler from man:em[4].
This implementation had various bugs.  The unit conversion/scaling was wrong, and it also did not handle 82574L or man:igb[4] devices correctly.
With the new AIM code, it is expected most users will not need to manually tune this.
gitref:edf50670e215[repository=src]
(Sponsored by	BBOX.io).

[[wireless-networking]]
=== Wireless Networking

The LinuxKPI, particularly for 802.11, has been enhanced to support crypto offload and 802.11n and 802.11ac standards.
The man:iwlwifi[4] wireless driver is the first to make use of these new features supporting 802.11ac for some Intel Wi-Fi 5, and all of Intel Wi-Fi 6 and Wi-Fi 7 hardware. (Sponsored by The FreeBSD Foundation)

[[hardware]]
== Hardware Support

This section covers general hardware support for physical machines, hypervisors, and virtualization environments, as well as hardware changes and updates that do not otherwise fit in other sections of this document.

Please see link:https://www.freebsd.org/releases/{localRel}R/hardware[the list of hardware] supported by {releaseCurrent}, as well as link:https://www.freebsd.org/platforms/[the platforms page] for the complete list of supported CPU architectures.

[[hardware-virtualization]]
=== Virtualization Support

[[documentation]]
== Documentation

This section covers changes to manual (man:man[1]) pages and other documentation shipped with the base system.

[[man-pages]]
=== Man Pages

man:ps[1]: Document change in behavior for `-a`/`-A`.
Document the practical consequence of change gitref:93a94ce731a8[repository=src] that specifying `-a`/`-A` leads to printing all processes regardless of the presence of other process selection options (except for `-x`/`-X`, which command a filter).
gitref:eed005b57895[repository=src].
(Sponsored by The FreeBSD Foundation).

man:ps[1]: Change in behavior for option `-U`.
gitref:4e4739dd0745[repository=src]
(Sponsored by The FreeBSD Foundation).

man:ps[1]: Change of how current user's processes are matched.
gitref:7219648f60d1[repository=src].
(Sponsored by The FreeBSD Foundation).

man:ps[1]: Match current user's processes using effective UID.
This puts man:ps[1] of FreeBSD in conformance with POSIX.
gitref:1e8dc267ca91[repository=src].
(Sponsored by The FreeBSD Foundation).

man:mac_do[4]: Change of rules syntax; Provide hints and pointers.
gitref:0c3357dfa18f[repository=src].
(Sponsored by The FreeBSD Foundation).

man:firewire[4]: Add deprecation notice.
This was originally discussed as part of FreeBSD 15 planning, but did not happen in time.
Add the deprecation notice now, with an expectation that it will be removed before FreeBSD 16.
gitref:fc889167c319[repository=src].
(Sponsored by The FreeBSD Foundation).

Remove not-explicitly-requested columns with duplicate data in man:ps[1].
Before this change, when stacking up more columns in the display through command-line options, if user requested to add some "canned" display (through options `-j`, `-l`, `-u` or `-v`), columns in it that were "duplicates" of already requested ones (meaning that they share the same keyword, regardless of whether their headers have been customized) were in the end omitted.
gitref:7aa2f4826717[repository=src].
(Sponsored by The FreeBSD Foundation).

Enable vnet man:sysctl[9] variables to be loader tunable.
In gitref:3da1cf1e88f8[repository=src], the meaning of the flag `CTLFLAG_TUN` is extended to automatically check if there is a kernel environment variable which shall initialize the `SYSCTL` during early boot.
It works for all `SYSCTL` types both statically and dynamically created ones, except for the `SYSCTLs` which belong to VNETs.
Note that the implementation has a limitation.
It behaves the same way as that of non-vnet loader tunables.
That is, after the kernel or modules being initialized, any changes (for example via `kenv`) to kernel environment variable will not affect the corresponding vnet variable of subsequently created VNETs.
To overcome it, `TUNABLE_XXX_FETCH` can be used to fetch the kernel environment variable into those vnet variables during vnet constructing.
gitref:894efae09de4[repository=src]

[[ports]]
== Ports Collection and Package Infrastructure

This section covers changes to the FreeBSD Ports Collection, package infrastructure, and package maintenance and installation tools.

[[ports-packages]]
=== Packaging Changes

[[future-releases]]
== General Notes Regarding Future FreeBSD Releases
FreeBSD 15.0 is not expected to include support for 32-bit platforms other than armv7.
The armv6, i386, and powerpc platforms are deprecated and will be removed.
64-bit systems will still be able to run older 32-bit binaries.

The FreeBSD Project expects to support armv7 as a Tier 2 architecture in FreeBSD 15.0 and stable/15.
However, the Project also anticipates that armv7 may be removed in FreeBSD 16.0.
The Project will provide an update on the status of armv7 for both 15.x and 16.x at the time of 15.0 release.

Support for executing 32-bit binaries on 64-bit platforms via the `COMPAT_FREEBSD32` option will continue for at least the stable/15 and stable/16 branches.
Support for compiling individual 32-bit applications via `cc -m32` will also continue for at least the stable/15 branch, which includes suitable headers in [.filename]#/usr/include# and libraries in [.filename]#/usr/lib32#.

Ports will not include support for deprecated 32-bit platforms for FreeBSD 15.0 and later releases.
These future releases will not include binary packages or support for building packages from ports for deprecated 32-bit platforms.

The FreeBSD stable/14 and earlier branches will retain existing 32-bit kernel and world support.
Ports will retain existing support for building ports and packages for 32-bit systems on stable/14 and earlier branches as long as those branches are supported by the ports system.
However, all 32-bit platforms are Tier-2 or Tier-3, and support for individual ports should be expected to degrade as upstreams deprecate 32-bit platforms.

With the current support schedule, stable/14 will reach end of life (EOL) around 5 years after the release of FreeBSD 14.0-RELEASE.
The EOL of stable/14 will mark the end of support for deprecated 32-bit platforms, including source releases, pre-built packages, and support for building applications from ports.
With the release of 14.0-RELEASE in November 2023, support for deprecated 32-bit platforms will end in November 2028.

The Project may choose to alter this approach when FreeBSD 15.0 is released by extending some level of support for one or more of the deprecated platforms in 15.0 or later.
Any alterations will be driven by community feedback and committed efforts to support these platforms.
