Skip to content
audiotale.net
Sign in
NewsNews

OpenBSD 8.0 released: bigger amd64 address space, 64-CPU guests and post-quantum TLS by default

The 61st OpenBSD release raises the amd64 kernel address space to 512G, adds arm64 hibernate, hardens httpd and relayd, and ships LibreSSL 4.4.0 and OpenSSH 10.6.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What happened
  3. Background
  4. How it works
  5. What it means
  6. What we don't know yet
  7. What to watch next
  8. Sources

OpenBSD 8.0 shipped on 20 October 2026. It is the project's 61st release and a broad one: the amd64 kernel can now address far more virtual memory, arm64 laptops gain hibernate, the hypervisor can give guests up to 64 virtual CPUs, and the web and relay daemons now reject a class of request-smuggling tricks. For anyone running OpenBSD as a firewall, router or server, the release also brings post-quantum key exchange to TLS by default and a fresh round of security fixes.

Key points

  • OpenBSD 8.0 was announced on 20 October 2026 by Theo de Raadt on the openbsd-misc mailing list and is the project's 61st release.
  • The amd64 kernel's virtual address space grows from 4G to 512G, and the direct map now sits at a random location; arm64 gains hibernate.
  • vmd(8) now supports up to 64 virtual CPUs per guest, and httpd(8) and relayd(8) reject CL.TE request smuggling and switch their default TLS ciphers from "compat" to "secure".
  • LibreSSL 4.4.0 prefers the X25519MLKEM768 hybrid post-quantum group for TLS 1.3 in libtls, and OpenSSH 10.6 adds experimental mldsa44-ed25519 composite signatures.
  • Pre-built packages were available on release day for six architectures; amd64 has 13,060.

What happened

The announcement went to the openbsd-misc list on 20 October, with the full change list on the project's OpenBSD 8.0 page. As usual, the project repeats its tagline about "only two remote holes in the default install" in a heavily audited base system, a claim that covers the default install, not every package or every non-default service.

Kernel and memory. On amd64 the kernel's virtual address space is raised from 4G to 512G, and the direct map of physical memory is placed at a random location instead of a fixed one, which makes memory-corruption exploits harder to aim. Swap encryption is faster on amd64 and arm64 because it now uses CPU AES instructions. arm64 gains hibernate support and bounce buffers.

Other architectures. On riscv64 the kernel detects CPU extensions and advertises them to userland through elf_aux_info(3); it also gains support for the "V" vector extension and the Sstc timer extension, plus new imsic(4) and aplic(4) drivers for the RISC-V Advanced Interrupt Architecture. sparc64 moves to the LLVM toolchain. Support for loongson was retired because it does not work with Clang 22.

Virtualisation. vmd(8) now supports up to 64 VCPUs per guest, x2apic in guests, MSI and MSI-X virtio interrupts and checksum offload. Emulation of the i82093aa IOAPIC and an i82489dx-compatible LAPIC was added, which the notes say fixes 32-bit Linux guests. VM ownership is managed with files, and the hypervisor was hardened against malformed ELF files.

Graphics and hardware. The drm(4) graphics stack was updated to Linux 6.18.53, and inteldrm(4) adds support for Intel Arc A-Series (DG2/Alchemist) cards. Ethernet gains em(4) support for Intel Panther Lake and Wildcat Lake and ix(4) support for the Intel E610. The Qualcomm Wi-Fi drivers qwx(4) and qwz(4) get many fixes, including 802.11n and 40 MHz channels. New drivers include samsabi(4), sambat(4) and rkotp(4).

Security and networking. httpd(8) rejects CL.TE request smuggling and obs-fold, and both httpd(8) and relayd(8) change their default TLS cipher set from "compat" to "secure". smtpd(8) gets privilege-separation hardening, and smtpd(8) and httpd(8) are randomly relinked at boot. Bundled software received CVE fixes, including Expat 2.8.4 (three CVEs), several Perl fixes, X server and libXfont fixes, and four nsd(8) CVEs, as listed in the release notes. unveil(2) now restricts man(1), makewhatis(8) and man.cgi(8), syspatch(8) is hardened against malicious scripts, and pax(1) no longer extracts archives outside the working directory. For routing, a new RPKI-to-Router daemon, rtrd(8), and its control tool rtrctl(8) were imported, and bgpd(8) and rpki-client(8) got fixes. acme-client(1) gains external account binding and wildcard alternate names.

Background

OpenBSD is a security-focused Unix-like operating system that ships twice a year, with the base system developed as one tree and audited as a whole. Its reputation rests on secure defaults and on mitigations that other systems later copied, such as pledge(2) and unveil(2), the two system calls that let a program restrict itself to the files and operations it needs. Each release is supported through the next one, so the 7.9 release (the version this one upgrades from, according to the project's upgrade guide) is now on its way out.

The project's tooling is also why it matters outside its own user base. OpenSSH and LibreSSL both come from OpenBSD, and the versions bundled in the base system are often the first to carry the project's newest ideas.

How it works

Two changes deserve a closer look.

Post-quantum TLS. LibreSSL 4.4.0's libtls now prefers X25519MLKEM768 as the TLS 1.3 key-exchange group. This is a hybrid: it combines classical X25519 with ML-KEM-768, a post-quantum key encapsulation scheme, so a connection stays safe if either half holds. The aim is to protect today's recorded traffic from a future quantum computer. In OpenSSH 10.6 the project goes further with experimental composite signatures, mldsa44-ed25519, which pair a post-quantum signature with Ed25519. OpenSSH 10.6 also disables the LZ77 compression dictionary to avoid a possible side channel, switches ed25519 to libsodium, and makes DisableForwarding=yes override PermitTunnel=yes.

Request smuggling. CL.TE smuggling exploits a disagreement between a front-end proxy and a back-end server about whether a request's length comes from the Content-Length header or from chunked Transfer-Encoding. Rejecting ambiguous framing in both httpd(8) and relayd(8) closes that gap whichever side the daemon is on.

The package counts below come from the release page.

OpenBSD 8.0 pre-built packages by architecture (arm and powerpc not yet published)packages
OpenBSD 8.0 pre-built packages by architecture (arm and powerpc not yet published) (packages)
packages
amd6413060
aarch6412907
riscv6411116
i38610659
sparc6410621
powerpc649564
mips649072

Source: OpenBSD 8.0 release page

What it means

For operators, the practical story is hardening. The randomised direct map and larger address space matter for kernel-exploit resistance, and the stricter HTTP parsing is relevant to anyone using relayd(8) as a reverse proxy in front of other services. The changed default ciphers could affect old clients that only speak legacy TLS settings, so test before upgrading a public-facing relay.

For virtualisation users, 64 VCPUs per guest and the fixes for 32-bit Linux guests make vmd(8) more usable as a small, auditable hypervisor, though it remains far less featureful than mainstream options. For laptop users, arm64 hibernate and the Qualcomm Wi-Fi work continue the project's slow progress on newer hardware. On the software side, the ports tree ships current toolchains and applications, among them Go 1.27.1, Rust 1.98.1, Python 3.14.7, Node.js 24.21.0, PostgreSQL 18.6 and Firefox 157.0, according to the release page.

Losers are few: loongson users lose a supported platform.

What we don't know yet

The release page still shows placeholder counts ("XXX") for arm and powerpc packages, and the announcement says packages for arm, powerpc and riscv64 were to follow, while the page already lists a riscv64 count; we report the page's figures and treat the arm and powerpc numbers as unpublished. We have not benchmarked any of the performance claims such as the faster swap encryption, and the notes do not give numbers for them. Independent coverage of the release had not appeared when we wrote this, so the details here rest on the project's own announcement and release notes.

What to watch next

Watch the errata page for the first syspatch fixes, which typically arrive within weeks of a release. Package builds for the remaining architectures should fill in the missing counts. The post-quantum TLS default will be a good test of real-world compatibility once more services start offering hybrid key exchange.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next