NetBSD 11.0 ships with three open security pull-ups the project chose to disclose rather than delay the release for

Sources: release announcement, HN discussion
Summary: NetBSD 11.0 was released on 2026-08-01 with three security pull-ups still open, and the project named them in the announcement instead of holding the release: a missing local privilege check on hdaudio(4) ioctl commands (PR 60492), a remotely triggerable null pointer dereference in ipfilter (PR 60484), and a use-after-free in pf fragment reassembly (PR 60485). The announcement states that IPF and PF are not included in any released kernel by default, and that the fixes are targeted for 11.1 within two months. It also states the volume of security issues found or suspected has risen with AI tooling to the point that shipping with no open issues is no longer achievable.
Why it matters: The hdaudio issue reaches default installs and the announcement gives a manual workaround of removing /dev/hdaudio*, while the ipfilter and pf issues need those subsystems built in, so upgrade exposure is one item for most installations.