CheriBSD

CheriBSD 26.07 Release Notes

Overview

Welcome to the Summer 2026 (26.07) release of the CheriBSD operating system. As well as a general update of the baseline FreeBSD OS (corresponding to CURRENT as of May 2025) from which CheriBSD is derived, we have introduced several new research components which will be of interest to the CHERI and CheriBSD community:

  • A new cheribsd-update (https://man.cheribsd.org/cgi-bin/man.cgi/release-26.07/cheribsd-update.8) tool is available to update from the previous release, 25.03, without reinstallation. Details for how to use this can be found in the "Updating an existing system" section of the Getting Started with CheriBSD guide.
  • DTrace (https://man.cheribsd.org/cgi-bin/man.cgi/release-26.07/dtrace.1) has been ported and can be used to trace a live CheriBSD kernel.
  • Library Compartmentalization (https://man.cheribsd.org/cgi-bin/man.cgi/release-26.07/c18n.7) has matured further and exports new APIs to allow stack scanning by garbage collectors like in V8. While this implementation is capable of running diverse workloads such as a full CHERI desktop environment, it is neither complete nor intended to be secure.
  • bhyve (https://man.cheribsd.org/cgi-bin/man.cgi/release-26.07/bhyve.8) VMs can now make outbound network connections when using the slirp backend, removing the need for a tap interface in many cases.
  • PF (https://man.cheribsd.org/cgi-bin/man.cgi/release-26.07/pf.4) has been ported and can be used as a packet filter for CheriBSD systems.
  • To strengthen library compartmentalization, the optional function pointer wrapping introduced in the previous release, 25.03, is now always enabled for compartmentalised processes.
  • To strengthen memory safety for thread-local storage, and to permit its compartmentalisation in a future release, a new ABI has been enabled by default. To maintain compatibility with the previous release, 25.03, Morello is using a transitional ABI, but the next release will remove this compatibility.
  • We have updated the toolchain, run-time linker, and C start-up code to further reduce the bounds of the executable capabilities.
  • OpenSSL's optimised assembly routines have been ported to pure-capability Morello.
  • Most historic cheri/cheric.h capability query and manipulation APIs have been removed in favour of the corresponding OS-independent cheriintrin.h APIs. The few that remain have been renamed to adhere to the same naming convention.
  • The historic vaddr_t type is no longer defined in favour of its long-standing replacement ptraddr_t. ptraddr_t itself is also now no longer defined in stdint.h, only stddef.h.
  • With some caveats detailed below, ZFS is no longer regarded as experimental, and is now the default filesystem in the installer instead of UFS, aligning with upstream FreeBSD's defaults.

As with previous releases, the default CheriBSD kernel on Morello ships with debugging features enabled, which should be disabled by booting a non-debug kernel before any performance benchmarking is performed. Additionally, before publishing benchmark results on Morello, we strongly encourage reading the report Early performance results from the prototype Morello microarchitecture.

Known Issues

  • More advanced ZFS features not enabled in the installer's default configuration, such as non-LZ4 compression, deduplication, and non-disk (referred to as "stripe" in bsdinstall) vdevs (e.g. mirroring or RAIDZ) are untested and should be regarded as experimental.

  • DTrace requires a pure-capability kernel, and its kinst provider is not supported.

  • This release includes an upstream FreeBSD change to IPFW (https://man.cheribsd.org/cgi-bin/man.cgi/release-26.07/ipfw.4) which breaks backwards compatibility. This means a 25.03 userspace will not be able to configure IPFW for a 26.07 kernel, and so if you are upgrading a system using IPFW it may deny all network packets after rebooting when prompted by cheribsd-update. For such systems, ensure you have serial or video console access in order to finish the update and restart the IPFW service, or disable IPFW for the duration of the update if you only have network access.

Using Morello as a Desktop

New installations of the latest CheriBSD release have an option to enable the desktop packages during the install process.

If you have already installed the latest version of CheriBSD but did not install the desktop packages you can add them later; log in as root or use sudo to add the following packages to the system: 

pkg64c install cheri-desktop (provides DRM, Wayland and the general GUI system)
pkg64 install cheri-desktop-hybrid-extras (provides Chromium and other applications)

Make sure that your user ID is in the video group; if not, use: 

pw groupmod video -m username

Add the following lines to /boot/loader.conf: 

dtb_load="YES"
dtb_type="dtb"
dtb_name="/boot/dtb/arm/morello-soc.dtb"

Ensure that a USB keyboard and mouse, as well as an HDMI monitor capable of handling full-HD input (all modern monitors), are connected to the desktop.

Reboot your system and you will be presented with a graphical login screen.

24th July 2026