NetBSD 10.2 security fixes close a remote kernel bug in ipfilter

A NetBSD box at the edge of a network, filtering traffic with ipfilter, has been carrying a kernel flaw that someone outside the machine can set off. The bug is a remotely triggerable null pointer dereference in ipfilter, meaning the kernel tries to read memory through a pointer that leads nowhere. In kernel code, that usually ends with the whole system going down.

The NetBSD Project shipped the fix on September 15 in NetBSD 10.2, the second point release of the NetBSD 10 stable branch. The same release closes a 4-byte leak of kernel stack data through TCP timestamps, the counters hosts attach to packets to measure round-trip time. Four bytes is not much, but stack memory can hold kernel addresses, and a leaked address is what an attacker needs to aim an exploit past randomized memory layouts.

Some fixes come with no details

NFS, the network file-sharing service, and telnet each get the same one-line entry: “fixed various security issues.” Neither lists a CVE, so the changelog gives you no way to judge how serious they were. If you run NFS on NetBSD 10, the missing detail is a reason to patch sooner.

The bundled third-party code moves too. OpenSSL goes to 3.0.21, Xorg to 21.1.24, and xkbcomp to 1.5.0, each for security fixes. libXpm picks up upstream fixes for CVE-2026-4367, and the unbound DNS resolver gets a patch for CVE-2025-11411. The kernel also now enforces access checks on the /dev/hdaudio device.

Upgrade in the right order

Booting an installation image and selecting Upgrade handles the job. Admins using other methods need to update the kernel and modules first, reboot, and then update userspace. Package repository URLs need adjusting, all third-party packages need updating, and a new gpufw set may need a separate install through sysinst.

Hashes for every file in the distribution are signed with the NetBSD Security Officer’s PGP key. Check them before the image goes anywhere near a production machine.