NetBSD 11.0 ships RISC-V, a 10 ms boot kernel, and 39 architectures — and publishes its own security bugs

July 30, 2026. August 1, 2026. 1993. Three dates that frame a release that shouldn’t exist — and does. NetBSD 11.0 is the nineteenth major release of an operating system whose first version shipped when Mosaic was the hot new browser. It runs on 39 distinct architectures, from a Commodore Amiga to a Nintendo Wii to a brand-new RISC-V single-board computer. Its new MICROVM kernel boots in 10 milliseconds on 2020-era hardware. And it ships with three documented, unfixed security vulnerabilities — on purpose.

The RISC-V inflection point

RISC-V is the headline feature, and it’s not ceremonial. NetBSD 11.0 is the first stable BSD release to ship production-ready 64-bit RISC-V support. You can install it today on a StarFive VisionFive 2, a PINE64 STAR64, an Allwinner D1-based board like the MangoPi MQ Pro, or just spin it up in QEMU. The port includes PCI/PCIe, a hardware TRNG driver, temperature sensors, and crash(8) kernel debugger support.

This matters because RISC-V is crossing the chasm from academic curiosity to industrial platform, accelerated by US semiconductor export restrictions and the rapid maturation of the Chinese RISC-V ecosystem. Having a BSD that boots natively on these SoCs — without proprietary blobs, without board support packages that bitrot after three kernel releases — is a political and technical milestone. NetBSD was the first OS to run on a DEC Alpha, the first to boot on an Armv6 Raspberry Pi, and now it’s the first BSD with a stable RISC-V port. The pattern holds.

A 10-millisecond VM kernel

The MICROVM kernel for x86 (both i386 and amd64) is the other structural addition. It leverages PVH boot, VirtIO MMIO devices, and a suite of kernel optimizations to cold-start a VM in roughly 10 ms on a 2020-era CPU. You invoke it with QEMU’s -kernel flag — no bootloader, no firmware.

For context: Firecracker, the microVM engine AWS built for Lambda and Fargate, targets similar boot times. NetBSD now hits that ballpark on the same hardware, with the full NetBSD network stack and a firewall (npf) that gained Layer 2 filtering and user/group-based rules in this release. If your infrastructure spans RISC-V embedded nodes and x86 cloud instances, NetBSD 11.0 is the only OS that gives you a single administration surface across both.

Linux binaries, no Linux required

The compat_linux(8) layer receives its most substantial update in years. Newly supported syscalls include epoll (implemented over kqueue), clone3, close_range, renameat2, statx, inotify, sync_file_range, syncfs, POSIX message queues, and memfd_create. If you compile a Linux binary against a recent glibc, you have a reasonable shot at running it unmodified on NetBSD.

This isn’t a container runtime — you won’t be running Docker workloads — but for the self-hoster who wants to run a mix of Linux services and native NetBSD daemons on the same VPS or Arm board, it’s a genuine migration path. The kernel’s Linux /proc emulation now includes sysvipc and self/limits, closing gaps that previously broke monitoring tools and init systems.

39 architectures is not a gimmick

The full platform list reads like a museum catalog, but the maintenance is real. NetBSD 11.0 ships with:

• Qualcomm Snapdragon X Elite initial support: battery and charger sensors, GPIO, I2C
• Raspberry Pi 5 UEFI boot support with improved peripheral handling
• Nintendo Wii: standalone bootloader, hardware AES engine for disk encryption/Wi-Fi acceleration, DVD drive driver, bwi(4) WLAN
• Motorola 68000: new virt68k port for QEMU with paravirtualized devices
• PowerMac G5: fan control, I2C/OpenPIC improvements, PaX MPROTECT and ASLR enabled by default
• x86: temperature sensors for AMD Turin, Strix Point, and Zen 5 CPUs; Intel TCO watchdog support; thinkpad(4) charge control via sysctl
• Sharp X68000: Sixel graphics sequences on the framebuffer console
• HP 9000/300 and 400 series workstations, dating from the late 1980s

None of this is cosmetic. The mac68k port gained a battery driver for PowerBook 1xx laptops. The x68k port can now render Sixel graphics. These machines are 25 to 35 years old, and NetBSD keeps shipping a modern kernel — with jemalloc 5.3.0, OpenSSH 10.3, OpenSSL 3.5.7, and ZFS — on silicon that predates USB.

pkgsrc: the secret weapon

The kernel isn’t the only thing that spans architectures. pkgsrc, NetBSD’s package management framework, tracks over 27,000 packages and runs on 23 platforms including Linux, macOS, Solaris, and illumos. If you’re running NetBSD on a MIPS-based Cobalt Qube from 2001, you can pkg_add tmux and get tmux 3.6b — the same version that ships on amd64. That’s not backward compatibility; that’s forward portability.

The 11.0 release ships with pkg_install-20260227, which is a minor bump, but the important signal is that pkgsrc continues to track upstream. GCC 12.5.0, LLVM, OpenSSL 3.5.7, OpenSSH 10.3, Postfix 3.11.2, BIND 9.20.24, unbound 1.25.1 — these are current versions, not museum pieces. When the OpenSSH project dropped DSA key support, NetBSD 11.0 followed suit and documented the breaking change. You can run a NetBSD 11.0 machine as a DNS resolver, a mail server, or a firewall with the same software versions you’d deploy on any other Unix.

For the self-hoster evaluating whether NetBSD is a toy or a tool: the package set alone answers the question. It’s smaller than Debian’s 60,000+ packages, but it’s curated. You won’t find three different Markdown parsers or five init system alternatives. You’ll find one of each thing that matters, maintained to build on 39 architectures.

The transparency play

The most discussed aspect of this release isn’t technical. NetBSD 11.0 ships with three open security advisories, and the release notes address them directly:

“We can’t publish a release without open issues. Instead of delaying the release further to fix them — new ones are being reported all the time — we’ve chosen to be transparent about this.”

The three advisories are: a missing privilege check on hdaudio(4) ioctls (trivial workaround: remove /dev/hdaudio*, audio still works), a null pointer dereference in ipfilter (not included in any default kernel), and a use-after-free in pf fragment reassembly (deprecated, also not in default kernels). NetBSD 11.1 is targeted within two months with all fixes backported.

Compare this to the industry norm: releases delayed by six months for non-exploitable issues, zero communication about the backlog, and an implicit message that vulnerability-free software exists. NetBSD’s approach — here are the bugs, here are the workarounds, here’s when we’ll fix them — is the security posture you want from an OS you might run on your Nintendo Wii or your Snapdragon X Elite laptop. Trust isn’t built on perfection; it’s built on disclosure.

Verdict

NetBSD 11.0 is not a general-purpose server distribution. If you’re looking for Docker, Kubernetes, or an LLM inference stack, you’re in the wrong aisle.

Choose NetBSD 11.0 if:

• You’re deploying on RISC-V and need an OS with no proprietary blobs, a full network stack, and a built-in firewall.
• You manage a fleet of heterogeneous hardware — Arm, x86, MIPS, PowerPC — and want a single administration model.
• You’re building serverless functions or ephemeral VMs and need sub-15 ms boot times without leaving the BSD ecosystem.
• You maintain vintage hardware and want a modern kernel with current security updates and a package manager (pkgsrc) that still targets your platform.

Skip NetBSD 11.0 if:

• Your application stack depends on Docker or Linux containers — compat_linux bridges the binary gap, not the orchestration one.
• You expect commercial support — the project runs on donations and volunteer maintainers.
• Your daily driver needs the latest Wi-Fi 7 card or NVIDIA GPU — that’s not the target.

One number to close: 39. No other open-source operating system covers a hardware spectrum this wide. If your infrastructure strategy includes “run anywhere,” NetBSD 11.0 is the only OS that can prove it across three decades of silicon.

References

• Announcing NetBSD 11.0 — The NetBSD Project, July 30, 2026
• NetBSD 11.0 released! — Martin Husemann, NetBSD Blog, August 1, 2026
• NetBSD 11.0 Released With RISC-V Support, Enhanced Linux System Call Compatibility — Michael Larabel, Phoronix, August 1, 2026
• NetBSD 11.0 discussion — Hacker News, 276 points, August 2026