NetBSD released version 11.1 on November 2, 2026, with security fixes that include a kernel crash in its IPFilter packet filter and changes to certificate trust. The project says it brought forward this first point release of the NetBSD 11 stable branch to address security issues. For administrators, the release announcement supplies concrete reasons to schedule an upgrade, although this article reports the project's evidence rather than an installation test.
A packet can crash a stateful filter
The IPFilter bug report describes a specific condition: when the filter keeps connection state, an ICMPv6 error packet containing another ICMPv6 error can cause a null-pointer dereference and crash the kernel. That makes the filter's configuration relevant to assessing exposure. The report does not establish that every NetBSD machine is vulnerable under its current settings.
The ticket also records a regression test and the fix reaching the NetBSD 11 branch on August 2. Its inclusion in 11.1 therefore packages an earlier branch fix into a formal release; November 2 is not the date the correction was first written. The release notes identify the impact as potential denial of service.
Certificate updates extend beyond the base system
NetBSD 11.1 also updates Mozilla-derived root certificates. The linked security ticket records the removal of compromised certificate authorities from the mozilla-rootcerts packages and a separate update to the base system's certificate data. It also identifies an affected Python certifi package and a fix in pkgsrc-current.
For administrators, those separate entries suggest checking which trust store each application uses when planning the update. A base-system upgrade alone should not be treated as evidence that every application's certificate bundle has changed; the ticket tracks these as separate components. That is an operational inference from the maintenance record, not a compatibility result measured here.
The reboot belongs in the upgrade plan
The official instructions offer an installation-image Upgrade option. For other update methods, they specify the order: update the kernel and modules, reboot, then update userspace.
After deployment, the useful evidence to watch is whether the affected filter configuration remains stable and applications using updated trust data still connect to their intended services. The bug tracker provides a regression-test record for the packet-filter correction, but local behavior still needs checking on the systems being upgraded.