FreeBSD 14.5 ships: forty-three advisories patched, inotify in base

FreeBSD 14.5-RELEASE shipped September 8. The distribution sites headlined it as “hardware improvements and security fixes,” which is the kind of accurate description that conveys nothing. So let me tell you what is actually in it.

Forty-three advisories, one that matters more than the rest

Between February and August 2026, the project addressed 43 security advisories. That is a real number representing real work: TCP, DHCP, filesystem, and cryptographic library fixes across the board.

SA-26:08 is the one you need to care about. Remote code execution via malformed RPCSEC_GSS packets in the NFS subsystem. If you have a machine running NFS with any exposure to untrusted traffic, patch it. Full stop. The rest of the advisory list is noise compared to that sentence.

OpenSSL is now at 3.0.21. LLVM is at 21.1.8. Both had their own vulns in the 43-item list; both are addressed.

The kenv change

There is a new security knob that disables unprivileged access to the kernel environment. The kernel environment is populated by the loader and contains tunables and configuration that may include things you do not want any shell user reading. “Disable unprivileged kenv access” should have been the default in a previous decade. It is now a knob at least, and a knob set correctly is better than no knob.

The inotify situation

14.5 ships inotify_init(), inotify_add_watch(), and inotify_rm_watch() in base, with matching libc APIs. Native. Not the Linuxulator. A program that uses inotify for filesystem event monitoring can now be compiled directly against FreeBSD without modification.

The pragmatic case: inotify is in every build tool, editor, file watcher, log shipper, and container runtime written in the last fifteen years. Source compatibility without the Linuxulator is a genuine reduction in porting friction. Nobody has to argue with this.

kqueue has existed since 2000. It is better designed. It is available on macOS, DragonFly, and NetBSD. The argument for adding inotify is “lots of software uses it,” and that argument was always true. It was true in 2010 and nobody added it then because “lots of Linux software uses it” was not considered sufficient reason to import a Linux API into base.

I am not pretending the pragmatic case is wrong. I am noticing it has a direction, and that direction is not the direction FreeBSD historically pointed. Every Linux API that lands in base is a surface to maintain and a behavior contract inherited from a different project’s design choices. Those contracts compound.

Reasonable people disagree on whether the tradeoff is worth it. I am not a reasonable person on this subject.

The UEFI fix

The amd64 UEFI loader failure that bounced some machines on install is fixed. bsdinstall also restores UEFI boot-entry creation, which had gone missing without sufficient fanfare in a prior release. If you tried to install 14.4 on a machine and the UEFI path failed, this cycle is worth retrying.

What to do

14.5-RELEASE is now the current stable branch. Support runs to June 30, 2027. If you are on 14.4, the advisory list alone is reason enough to upgrade. SA-26:08 is the specific reason to upgrade this week and not next month.

The kernel security posts from earlier this week covered the Linux side of the fragmentation bug story. The FreeBSD toolchain stays ahead of most of that class of bug by virtue of a smaller attack surface and a project culture that still treats the base system as a coherent whole rather than a collection of independently-packaged subsystems.

That remains true at 14.5. Patch it anyway.