FreeBSD 14.5 is out, EuroBSDCon starts tomorrow

FreeBSD 14.5-RELEASE is out. September 8, on schedule. RC1 to RELEASE went clean enough that there isn’t a long errata story to tell, which is the best kind of release day.

The tty use-after-free that was not in the RC1 fix set got its own security advisory: FreeBSD-SA-26:62.tty. The TIOCSCTTY ioctl, the one that lets a process claim a controlling terminal, had a kernel use-after-free reachable by unprivileged local users for local privilege escalation. Patched in 14.4, 15.0, and 15.1 branches as well. If you were watching the RC1 announcement and thinking “okay but what else,” this was the other thing.

The RC1 piece covered the SNDCTL_DSP_SYNCSTART audio UAF and the HWPMC credential-transition bug in detail. Both are in 14.5. The HWPMC one is still the more interesting of the two if you care about side channels and what an unprivileged process can learn about a root process from PMU data.

What updated

LLVM went to 21.1.8. OpenSSL to 3.0.21. ncurses to 6.6. XZ to 5.8.3.

On XZ: 5.8.x is the post-Jia Tan cleanup series. New maintainers, reproducible build verification, and a security audit wrapped in 2025. Version 5.8.3 has been in distro trees for months without incident. If you are still reflexively flinching at XZ version numbers the way you were in March 2024, that is appropriate habit, but 5.8.3 is not where the risk is. If it were, you’d have heard about it already.

The root certificate bundle updated to NSS 3.123.1: some CAs added, some moved to untrusted. If you run a FreeBSD box that does TLS verification against the system bundle, freebsd-update fetch && freebsd-update install picks this up automatically. You do not need to do anything extra.

Hardware

ACPI now handles power management better on Apple Mac hardware with dual GPUs. That is a sentence I did not expect to appear in a FreeBSD release note, but here we are. The AHCI driver picked up support for additional SATA controllers. The ASMC driver dropped support for 32-bit Intel-based Macs. Those machines are old enough to vote and not quite old enough to drink. Anybody still running FreeBSD on one is doing it as a project, not production work, and they know what they signed up for.

EuroBSDCon opens tomorrow

EuroBSDCon 2026 opens tomorrow in Brussels and runs through September 13. The FreeBSD Summit is September 9 and 10. Tutorials Thursday and Friday, talks Saturday and Sunday at VUB’s main campus in Etterbeek. Whoever scheduled the RELEASE to ship the day before the FreeBSD Summit either planned it that way or got lucky. Either way the in-person crowd now has something concrete to discuss that is not a release candidate.

The full schedule is public. Proceedings usually surface within a few weeks of the conference end.

Upgrade

Standard drill: freebsd-update fetch && freebsd-update install, reboot, confirm you are on 14.5-RELEASE. If you are on 14-STABLE you already have most of this. If you are on 13.x, the conversation is in the RC1 piece and it should be short.

ZFS users: 14.5 ships the same OpenZFS version as 14.4 on the stable branch. The OpenZFS 2.3 story with BLAKE3 and dRAID encryption is about the upstream release, not what is in FreeBSD 14.5 base. Keep those two things separate in your head.