FreeBSD 15.0 Ships, Replacing Heimdal Kerberos and Adding Linux-Compatible inotify

FreeBSD 15.0-RELEASE shipped on December 2, 2025 as the first release from stable/15. FreeBSD 15.1 followed on June 16, 2026. By July 2026, 15.1 is the production release, while 15.0 remains a supported legacy point release until its published end-of-life date.

The 15.0 headline set is substantial: an optional packaged base system managed by pkg, MIT Kerberos replacing Heimdal by default, native and Linuxulator implementations of inotify, retirement of several 32-bit platforms, newer OpenSSL and OpenZFS, and package/firmware changes intended to improve installability. Some earlier summaries misstated the UFS change and the exact upstream versions; the release notes provide a cleaner record.

Pkgbase arrived as a technology preview, not a forced migration

FreeBSD 15.0 introduced a new installation choice in bsdinstall: traditional distribution sets, updated by freebsd-update, or a base system installed as packages from the FreeBSD-base repository and managed with pkg.

The release announcement calls pkgbase a technology preview. It was nevertheless used by default for FreeBSD virtual-machine and public-cloud images, making it more than a developer-only prototype. Packaging base components creates explicit package ownership, dependency, repository, and upgrade metadata and brings base management closer to the tooling already used for Ports packages.

Traditional installations were not converted automatically. The announcement says distribution sets and freebsd-update remain supported for the lifetime of stable/15, with their removal planned for FreeBSD 16. That coexistence means administrators must know which method owns a host; invoking both update paths against one installation is not supported.

The 15.0 release notes also document late infrastructure changes for prerelease pkgbase users. Those migration details are historical warnings against treating a technology preview as a frozen interface, not commands current 15.1 systems should copy blindly.

MIT Kerberos became the default base implementation

FreeBSD 15.0 imported MIT Kerberos 1.22.1 as the default replacement for Heimdal 1.5.2. This was not merely a version bump within one codebase. MIT and Heimdal implement the same protocol family but differ in administration commands, database handling, configuration, extensions, and operational assumptions.

The release notes retain a build-time WITHOUT_MITKRB5 option for Heimdal in FreeBSD 15 and state that Heimdal is planned for complete removal in FreeBSD 16. Operators with KDCs, keytabs, PAM integration, NFS Kerberos, cross-realm trust, or automation therefore need migration testing rather than assuming standards compatibility makes implementation details identical.

The release notes attribute the MIT Kerberos import to FreeBSD Foundation sponsorship. That is useful provenance: the transition involved a long series of commits and integration work, not a single library replacement.

Inotify compatibility has two distinct layers

FreeBSD 15.0 natively implements the Linux inotify file-notification interface. The exact release-note wording corrects a common overstatement: the FreeBSD system calls themselves are not API-compatible with Linux, but FreeBSD’s libc exposes an API-compatible interface so native software using inotify can run unmodified.

Separately, the Linuxulator implements the Linux inotify system calls for Linux binaries. Together these changes reduce polling fallbacks and porting patches for editors, build tools, synchronization software, language development servers, and other programs that expect inotify semantics.

Compatibility does not mean every Linux edge case or resource limit behaves identically. Applications still need tests for recursive watch strategy, queue overflow, rename behavior, descriptor limits, and events under the filesystem they actually use. The important historical correction is that libc provides native API compatibility while the Linuxulator supplies Linux syscall compatibility; they are related but not the same mechanism.

The UFS headline was reliability and soft updates, not “64-bit inodes by default”

An earlier description claimed that FreeBSD 15 enabled 64-bit UFS inode numbers by default. The 15.0 release notes do not say that. They report significantly improved reliability for UFS volumes with more than two billion inodes by fixing signed interpretation and extension of 32-bit inode numbers into ino_t.

The actual default change is that newfs now enables soft updates when creating a new UFS filesystem. Existing filesystems are not silently reformatted by upgrading. The release also extends the practical date limit of old UFS1 filesystems from January 2038 to February 2106.

These distinctions matter because an inode ABI fix, an on-disk format, and a newfs default have different migration consequences. Release reporting should not collapse them into a nonexistent format switch.

Cryptography and storage shipped at precise versions

FreeBSD 15.0 shipped OpenSSL 3.5.4, the then-current long-term-support branch, with QUIC and standardized post-quantum algorithms highlighted in the announcement. OpenSSH moved to 10.0p2 and enabled quantum-resistant key agreement by default.

The OpenZFS import in the final 15.0 release notes is 2.4.0-rc4, not the final 2.4.0 label used in some previews and summaries. FreeBSD 15.1 subsequently updated OpenZFS to 2.4.2 and OpenSSL to 3.5.6. Stating both snapshots avoids attributing a 15.1 maintenance update to the original December release.

Other storage changes included ZFS block-cloning support through copy_file_range, NFSv4.2 Clone support for suitable ZFS exports, and removal of vinum volume support. Each has configuration and compatibility conditions beyond the headline.

Hardware scope and installation policy changed too

FreeBSD 15 retired i386, armv6, and 32-bit powerpc as supported hardware platforms. The release notes identify armv7 as the remaining supported 32-bit platform while 32-bit application compatibility continues on corresponding 64-bit systems where provided.

The installer gained support for downloading firmware packages after base installation. Boot-only and mini-memory-stick images included Intel iwlwifi and Realtek rtw88 firmware packages, and the DVD added a broader release firmware metapackage. These changes improve the chance of installing over supported wireless hardware, but they do not imply universal Wi-Fi chipset or feature support.

A dedicated FreeBSD-ports-kmods repository also addresses kernel-module ABI alignment for release users. That is especially relevant to graphics and other out-of-base modules whose interfaces can differ from stable-branch package builds.

The support dates are specific, not a vague “four-year release”

As of July 12, 2026, the FreeBSD Security page lists 15.0-RELEASE support through September 30, 2026, 15.1-RELEASE through March 31, 2027, and the stable/15 branch through December 31, 2029. A point release and its major stable branch therefore have different lifetimes.

Users should follow the currently supported point release rather than infer that installing 15.0 grants support until the end of stable/15. The quick arrival of 15.1 is normal release-branch progression: it accumulated fixes and upstream updates while retaining the major architectural direction established by 15.0.

FreeBSD 15.0’s significance is not one feature. It is the combination of a new base-management path, major authentication and compatibility changes, architecture cleanup, and an explicit transition period before FreeBSD 16 removes older mechanisms.

Related:

Sources: