SpencerJ

Unraid 7.3.2 is a security and bugfix release with an updated Linux kernel, a critical WebGUI security fix, Docker VLAN networking improvements, and 70+ updated base packages. This update is recommended for all users. Release Docs Bug Reports here please!

Unraid OS 7.3.2-rc.1 refreshes the Linux kernel, Docker, the Unraid API, and a broad set of base packages, with security-related updates across core networking, web, storage, and encryption components. This release also includes ZFS and QEMU updates, along with storage, Docker, and system improvements. Full Release Notes

Yes, this is the plan! Look for a full video on this coming soon https://www.youtube.com/@uncastshow

Unraid 7.3.1 is now stable. Read the full announcement on the Unraid blog. For step-by-step upgrade instructions, see Updating Unraid. Release HighlightsSecurity Updated nginx (1.30.1) to address 13 CVEs Updated bind (9.20.23) to address 9 CVEs Updated rsync (3.4.3) to address 6 CVEs Updated dnsmasq (2.92rel2) to address 6 CVEs Updated avahi, glibc, and jq with NVD-referenced security fixes Updated Docker to 29.5.1, including upstream Docker CVE fixes Linux Kernel Update to 6.18.33-Unraid Docker Docker engine updated to 29.5.1 Fix: Docker container dropdown menu remains usable when many containers are shown Storage Update ZFS to 2.4.2 Fix: unassigned spare disks now spin down as expected Fix: mirrored boot pools can recover from a degraded state after a member device returns for cache pool usage Fix: relaxed pool name validity check when importing existing pools to match pre-7.3 validation Fix: replacing an online raidz device no longer fails in affected configurations WebGUI / System Fix: restored Connect version-check logic so required updates are detected correctly Fix: file uploads now handled correctly on Safari iOS Networking Fix: dhcpcd no longer waits 60 seconds to obtain an IP address on affected systems Links Release Notes Blog Post Bug Reports

7.3.1 is coming too.

Unraid 7.2.7 is out with security updates across several core packages, a kernel upgrade, Docker fixes, and WebGUI corrections. Upgrading is recommended, particularly for security-sensitive environments. Changes vs. 7.2.6 Security Security updates for docker, nginx, glibc, jq, avahi, glibc support libraries, curl, gnutls, and php Containers / Docker Docker updated to 29.5.1 Fix: Docker containers on VLAN networks now keep their configured gateway after updates Fix: Docker container context menus stay reachable on pages with many containers WebGUI / System Fix: Connect version checks restored in the server plugin Linux kernel Kernel upgraded to 6.12.90-Unraid Fix: performance regression affecting Docker-enabled systems and some USB 3.1 devices Updated packages (11) aaa_glibc-solibs: 2.42 → 2.43 avahi: 0.8-3_SBo_LT → 20260508 (CVE-2023-38469, CVE-2023-38470, CVE-2023-38471, CVE-2023-38472, CVE-2023-38473) curl: 8.19.0 → 8.20.0 (CVE-2026-4873, CVE-2026-5545, CVE-2026-5773, CVE-2026-6253, CVE-2026-6276, CVE-2026-6429, CVE-2026-7009, CVE-2026-7168) docker: 29.3.1 → 29.5.1 glibc: 2.42 → 2.43 (CVE-2025-15281, CVE-2026-0861, CVE-2026-0915) gnutls: 3.8.12 → 3.8.13 (CVE-2026-33846) jq: 1.6 → 1.8.1 (CVE-2024-53427, CVE-2025-9403) libvirt-php: 0.5.8-8.3.29 → 0.5.8-8.3.31 nginx: 1.27.2 → 1.30.1 (CVE-2025-53859, CVE-2026-1642, CVE-2026-27651, CVE-2026-27654, CVE-2026-27784, CVE-2026-28753, CVE-2026-28755, CVE-2026-32647, CVE-2026-40460, CVE-2026-40701, CVE-2026-42934, CVE-2026-42945, CVE-2026-42946) php: 8.3.29 → 8.3.31 (CVE-2025-14179, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568) zfs: 2.3.4_6.12.82_Unraid → 2.3.4_6.12.90_Unraid Known Issues See the 7.2.6 release notes for other known issues. Rolling Back If rolling back to a version earlier than 7.2.6, also see the 7.2.6 release notes. Upgrading For step-by-step instructions, see Updating Unraid. Links Release Notes — Full 7.2.7 release notes Blog Post — 7.2.7 announcement

thanks for the PR! I've updated the original post here as well.

Unraid 7.3.0 is now stable! Read the full announcement on the Unraid blog. For step-by-step upgrade instructions, see Updating Unraid. Highlights Internal Boot + Licensing Boot Unraid from an internal NVMe, SSD, or eMMC device instead of a USB flash drive Mirrored boot pool support for redundancy New onboarding wizard guides new users through setup including boot method selection; existing users can access it under Tools → Onboarding Wizard All new and replacement keys use TPM-based licensing when possible; existing flash-based licensing continues to work unchanged Security Kernel fixes for CVE-2026-31431 (Copy Fail), CVE-2026-43284 and CVE-2026-43500 (Dirty Frag), both local privilege escalation vulnerabilities. Users upgrading from 7.2.5 or earlier get both fixes in one update. Package security updates to GnuTLS, Info-ZIP, telnet, X.Org Server, and bind Docker Update Docker to 29.4.3 New optional fixed MAC address field in Docker templates for stable container network identity across restarts Storage Update ZFS to 2.4.1 Corrupted files now visible in ZFS pool status ZFS ARC max size now configurable at Settings → Disk Settings → Tunable (zfs_arc_max) Various ZFS pool replacement, spin-down, and wake fixes Virtualization Update QEMU to 10.2.2 and libvirt to 12.2.0 Deprecated VM machine types updated automatically on startup File Manager Performance improvements and several edge case fixes for move, rename, and upload operations Linux Kernel Update to 6.18.29-Unraid Known Issues During internal boot setup, the WebGUI may show Array Offline. DO NOT restart or remove your flash drive during this process. Some Docker containers on VLAN networks may still fail to receive DHCP after upgrading from 7.2.4 or 7.2.5. Under investigation. Some UPS devices may report "Online No battery detected." The NUT plugin may provide a workaround. Rolling Back Do not roll back to 7.2.6 or earlier after enabling internal boot or TPM-based licensing. If you upgrade ZFS pool features, earlier Unraid releases may not be able to import those pools. If considering a rollback below 7.3.0, also see the 7.2.6 release notes. Links Release Notes Blog Post Internal Boot FAQ TPM Licensing FAQ Bug Reports

Yes, it's a special release Friday! Unraid 7.2.6 is out with a Linux kernel upgrade to address CVE-2026-43284 and CVE-2026-43500, the Dirty Frag local privilege escalation vulnerability. All users should update! Have a great weekend! Changes vs. 7.2.5 Security Upgrade the Linux kernel to address CVE-2026-43284 and CVE-2026-43500, the Dirty Frag local privilege escalation vulnerability Linux kernel version 6.12.87-Unraid Known Issues See the 7.2.5 release notes for other known issues. Rolling Back If rolling back to a version earlier than 7.2.5, also see the 7.2.5 release notes. Upgrading For step-by-step instructions, see Updating Unraid. Links Release Notes — Full 7.2.6 release notes Blog Post— 7.2.6 announcement

Unraid 7.3.0-rc.2 is out. This build targets fixes from rc.1 testing across internal boot, storage, virtualization, Docker, WebGUI, and security. Full rc.1 changelog is included below for reference. This is release candidate software. Please use on test servers only. Changes from rc.1 Security Add WebGUI security hardening for authenticated-session request handling The included 7.3 kernel contains the fix for CVE-2026-31431, the Copy Fail local privilege escalation vulnerability Storage Add mvsas and smartpqi as built-in storage drivers for internal boot Fix: Address an md/unraid driver crash Fix: Correct ZFS pool replacement handling when a dropped device is marked REMOVED, so replacement workflows no longer leave the pool degraded with a stale new-device state or repeated overwrite warning Fix: Improve dedicated and split boot-pool detection after boot-pool devices are replaced with larger devices Fix: Allow adding a device to a formatted split boot pool when the data partition is formatted as ZFS or BTRFS Fix: Prevent creation of ZFS pools whose names start with reserved ZFS name prefixes: mirror, raidz, draid, and spare Containers / Docker Update Docker to 29.4.1 WebGUI / System New: Show chassis serial number in System Info when a valid chassis serial is available Fix: Keep the WebGUI responsive while adding Docker containers from the Add Container page Fix: Correct stale status display after affected storage replacement workflows Fix: Use online / offline instead of on-line / off-line in various text Virtualization Fix: Update deprecated VM machine types during startup so older VMs do not fail with unsupported QEMU machine-type errors after upgrading Fix: Restore the Unraid UEFI logo for VMs Fix: Show the assigned RenderGPU for the first VM in the VM list when using Virtio 3D LicensingFix: Improve TPM-based license replacement blacklist handling so a transferred TPM-based key is blocked without permanently blocking the underlying motherboard GUID from future valid activation Known Issues During internal boot setup, the WebGUI may show Array Offline while internal boot configures. DO NOT manually restart or remove your flash drive during this process. Internal boot requires boot storage accessible by built-in Linux drivers during startup. rc.2 expands coverage to mvsas and smartpqi, but devices requiring third-party drivers or post-boot configuration are not supported. Some invalid ZFS pool names that begin with reserved ZFS prefixes may fail without a clear WebGUI error. Choose a different pool name if creation does not complete. If a split boot-pool device is removed and another device is added immediately afterward, the slot count may not always update until the server is rebooted. See the Unraid OS Pre-release (Bugs & Feedback) board for issues reported by other testers. Rolling Back You can roll back to 7.3.0-rc.1 without issue if you have already enabled internal boot or switched to TPM-based licensing. Do not roll back to 7.2.5 or earlier after enabling internal boot or TPM-based licensing. If you upgrade ZFS pool features, earlier Unraid releases may not be able to import those pools. Follow the normal pre-release rollback process before moving between builds. If you are considering any rollback path below 7.3.0-rc.1, see the 7.2.4 release notes. UpgradingFor step-by-step instructions, see Updating Unraid. LinksRelease Notes -- Full 7.3.0-rc.2 release notes Blog Post -- rc.2 announcement Bug Reports -- Report issues here Internal Boot FAQ TPM Licensing FAQ

They should begin shipping next week sometime.

Unraid 7.2.5 is out today and is a recommended update for all users. This is a security and bugfix release. What's in this release: 3 WebGUI security fixes — required a logged-in session to exploit. Linux kernel 6.12.85-Unraid — patches CVE-2026-31431 (Copy Fail local privilege escalation) and CVE-2026-31430 (X.509 out-of-bounds access) Docker updated to 29.3.1 — includes runc fixes for CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 Fixed MAC Address field in Docker templates — addresses the MAC address churn introduced by Docker Engine 28; set a fixed value if your containers rely on a stable MAC for DHCP reservations, firewall rules, or monitoring Storage fixes — mover empty-disk action restored on systems with no pool assigned; non-standard partition layouts preserved on unassign/reassign Login page — custom case-model images restored (regression from 7.2.4) Unraid API — fixes a startup bootstrap timeout/restart loop and improves license state refresh Multiple CVEs patched across curl, OpenSSL, GnuTLS, libpng, xorg-server, libpcap, libtasn1, libXpm, p11-kit, PHP, xz, and more Breaking change: Docker containers may receive a new dynamically generated MAC address each time they are created - this is due to a change in Docker Engine 28. If a container needs a stable network identity for DHCP reservations, router or firewall rules, switch ACLs, monitoring, or similar workflows, set a fixed value in the new MAC Address field on the Docker template. This follows Docker Engine 28+ behavior for bridge and macvlan network endpoints; see the Docker Engine 28 release notes. Full Release Notes Blog Post For step-by-step upgrade instructions, see Updating Unraid in the docs. Got Bugs? Please report them here!

If you’re referring to u/spaceinvaderone, I can assure you he’s not active. We even tried getting him removed as a moderator when he came onboard here but our DMs were ignored by the current higher ranking mods who appear to be inactive

Thanks for the kind words on the pinned comment @Lolight On the NVMe guidance question: a few things worth clarifying. The combined failure scenario you’re describing, losing OS config and cached data simultaneously, assumes cache and boot are on the same device. That’s a user choice, not an Unraid default. Boot pools can also be mirrored across two devices, which provides straightforward protection against single-drive failure. These are mitigations that are already available to users today. On the ask itself — we’re a small team and have to be careful and honest about what we can commit to publicly.However, we actively monitor support trends, escalations, and public bug reports, and will take appropriate action if needed.

Comment on video is pinned: https://www.youtube.com/watch?v=ihpbZFPwWXw We have a ton of amazing stuff on deck for the rest of the year. I think you'll be happy!