Release of Red Hat Enterprise Linux 10.3 and 9.9

Red Hat has released the Red Hat Enterprise Linux 10.3 distribution, along with an update to the previous branch — Red Hat Enterprise Linux 9.9. Ready-to-use installation images are available for registered users of the Red Hat Customer Portal (public ISO images of CentOS Stream 10 and free RHEL builds for developers can be used for functionality testing). The release has been formed for x86_64, s390x (IBM System z), ppc64le (POWER9), Aarch64 (ARM64), and RISC-V (preview) architectures. The RHEL 10 branch will be supported until 2035 (+ 4 years of extended paid support), RHEL 9 — until the end of May 2032, and RHEL 8 — until 2029.

RHEL packages are not hosted in the public repository git.centos.org and are provided to clients only through a closed section of the website, where a user agreement (EULA) operates that prohibits redistribution of data downloaded through the customer portal, creating legal risks when using these packages to create derivative distributions. The source texts of RHEL remain available in the CentOS Stream repository, but it is not fully synchronized with RHEL and package versions in it do not always match those from RHEL. Rocky Linux, Oracle, and SUSE reproduce the source texts of rpm packages of RHEL releases as part of the OpenELA project.

Key changes in RHEL 10.3 (most of the noted changes are also present in RHEL 9.9):

• Support for post-quantum encryption algorithms has been expanded. SSH now supports the mlkem768nistp256-sha256 and mlkem1024nistp384-sha384 algorithms. In libreswan, support for post-quantum key exchange algorithms ML-KEM-768 and ML-KEM-1024 has been added to the implementations of IPsec and IKE (Internet Key Exchange) protocols. The rust-sequoia-sqv package, which implements the gpgv utility in Rust, now includes full support for post-quantum encryption algorithms defined in the new OpenPGP specification. The audit package has added support for post-quantum algorithms in TLS 1.3 and for using PSK authentication when transmitting logs to external hosts. OpenSC now supports the PKCS #11 v3.2 specification and post-quantum encryption.
• The eBPF and Perf subsystems have been synchronized with the Linux kernel 6.19.
• In the kernel builds for CentOS Stream, the RV (Runtime Verification) subsystem, designed for verifying the correctness of high-reliability systems, has included monitoring components 'sched' for analyzing the behavior of the task scheduler and 'rtapp' (Real-time application monitor) for tracking typical issues in applications running in real time.
• The rtla toolkit, used for analyzing realtime mode in the kernel, has added support for connecting custom eBPF handlers to perform actions when certain threshold values are exceeded, and the capabilities for analyzing EFI call stacks have been expanded with the timerlat utility.
• In the IMA (Integrity Measurement Architecture) mechanism, which is used to verify the integrity of operating system components through digital signatures and hashes, checks on certain file systems that were previously ignored (e.g., tmpfs and ramfs) have been tightened.
• The core module tboot (Trusted Boot) has expanded support for Intel TXT (Trusted Execution Technology).
• Improved support for Intel RDT (Intel Resource Director Technology) enables monitoring and limiting the usage of certain processor resources.
• An experimental driver amdxdna for AMD's NPU chips (Neural Processing Unit) has been included.
• The console tool image-builder is now available for building system images with specified parameters and settings. The bootc-image-builder utility has been deprecated but will continue to be supported throughout the RHEL 10 lifecycle. The web console now supports building images compatible with bootc from any base images available in the current system, including images from Fedora, CentOS Stream, and arbitrary containers. The naming of system image types is synchronized between the console tool and web interface (e.g., aws for Amazon Machine Image (AMI) and guest-image for QCOW2). Support has been added for creating custom builds for the Hummingbird distribution (a Fedora version based on containers).
• In the RHEL for Edge edition, the ability to deploy edge systems using FIDO Device Onboard (FDO) has been implemented. The FDO implementation in Rust (fdo-rs, fido-device-onboard) has been replaced with a Go variant (go-fdo), and the bash-based greenboot tool has been replaced with a Rust implementation (greenboot-rs). When updating, there is an automatic conversion of images from bootc to use greenboot-rs. Greenboot is used in atomically updatable versions of RHEL to check system status at boot and rollback to a previous version if issues are detected.
• In the fapolicyd (File Access Policy Daemon) framework, which determines which programs can be run by specific users, multi-threaded parallel processing of operations, dynamic database resizing, and integration with the systemd watchdog service have been implemented.
• New system roles (System Roles) have been added: auditd for automating the management of the system audit process; trustee_server and trustee_client for automating the deployment of confidential server and client components. of virtual machines with hardware memory encryption (CVM, Confidential Virtual Machine).
• In SELinux, the following rules have been transitioned to "enforcing" mode: powerprofiles_t,
  qgs_t,
  redfish_finder_t,
  sshd_auth_t,
  sshd_session_t,
  systemd_mountfsd_t, and
  systemd_oomd_t. The go-fdo-server service has been placed under SELinux protection.
• For dnf-automatic, reboot blocking is implemented during the automatic installation of package updates.
• A ‘--parkdb’ flag has been added to the rpmdb utility to optimize the RPM database when operating on media that is read-only.
• The package includes modules mod_security (firewall for web applications protection) and mod_security_crs (OWASP Core Rule Set) for Apache httpd.
• In the GNOME Kiosk composite manager, designed for creating internet kiosks, accessibility features have been enhanced. A special large panel has been added, the ability to enlarge areas on the screen, and an option to disable animations.
• In GNOME, the display settings now include an option to control automatic screen rotation based on accelerometer readings.
• Support for cameras with MIPI (Mobile Industry Processor Interface) has been implemented on systems with AMD chips.
• The performance of the virtio-fs driver for guest systems running Windows has been improved.
• The Podman toolkit now allows multiple static (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. assignments for a single network interface when creating a container.
• NetworkManager has added support for GENEVE tunnels and the CLAT (Customer-side Translator, 464XLAT) mechanism to enable applications that only support IPv4 to operate on hosts with IPv6. The Nmstate API can now be used to configure IPv4 over IPv4 (IPIP),
  IPv4 over IPv6 (IPIP6),
  IPv6 over IPv6 (IP6IP6), and
  Simple Internet Transition (SIT).
• In Stratis, the logical volume management toolkit, the capability to convert unencrypted pools into encrypted ones has been implemented.
• Experimental (Technology Preview) support for the io_uring asynchronous I/O subsystem has been added (disabled by default, can be enabled through /proc/sys/kernel/io_uring_disabled).
• Experimental packages crypto-auditing-agent and crypto-auditing-log-parser have been added for tracing and auditing cryptographic operations performed by libraries in user space (eBPF and USDT checks are used for analysis).
• An experimental ability to pass smart cards to the GNOME Remote Desktop while using the RDP protocol has been added.
• Support for passwordless authentication methods has been added in the GDM (GNOME Display Manager), such as through biometric authentication and passkey technology.
• Support for the WEP (Wired Equivalent Privacy) protocol has been discontinued when connecting to wireless networks.
• The MCP Server has been recognized as ready for use, allowing the connection of AI agents and providing them access to system data for troubleshooting.
• An experimental AI assistant has been proposed, offering contextual hints and explanations in the command line. It can be used as a locally executed AI model or as an external service.
• The implementation of 'sealed' images has been stabilized, providing cryptographic integrity protection that ensures the running system matches exactly what was originally deployed and signed.
• Developer package versions have been updated: GCC 16.2, LLVM 22.1.8, Go 1.27.3, Rust 1.97, gdb 17.2, Valgrind 3.27.1, valkey 8.1, Node.js 26.
• Server package updates: iproute 7.0.0, netfilter 7.2, libreswan 5.4, libcap-ng 0.9.3 (with a new cap-audit utility), Grafana 12.4.3, firewalld 2.4.2, Podman 6.0.
• System packages have been updated: Binutils 2.46, audit 4.2.1, bootc 1.16.4, ostree 2026.3, opencryptoki 3.27.0, sequoia-sqv 1.5.0,
  SELinux 3.11, SystemTap 5.5, fwupd 2.1.6.
• New drivers have been added:
  • stmmac — STMicroelectronics Multi-Gigabit Ethernet
  • dwmac-starfive — StarFive DWMAC Ethernet
  • smbdirect — CIFS SMB Direct (RDMA)
  • dibs (Data Integrity Block Store)
  • spi-nor — SPI NOR flash
  • spi-cadence-quadspi — Cadence Quad SPI
  • spi-fsl-quadspi — Freescale QuadSPI
  • mmc-dw-starfive — StarFive MMC/SD
  • sdhci-of-k1 — SpaceMit K1 SDHCI
  • at24 — AT24 I2C EEPROM
  • amd-isp4 — AMD ISP4 (video capture device)
  • snd-sof-novalake — Intel NovaLake Sound Open Firmware
  • snd-soc-tas2781-i2c — TI TAS2781 I2C audio amplifier
  • dwc3 — Synopsys DesignWare USB3 DRD
  • cdns3 — Cadence USB3
  • xhci-plat-hcd — Generic xHCI
  • gpio-dwapb — Synopsys DesignWare APB GPIO
  • gpio-novalake — Intel Nova Lake GPIO ACPI
  • gpio-spacemit-k1 — SpaceMit K1 GPIO
  • spd5118 — SPD5118 temperature sensor
  • spacemit — SoC SpaceMit
  • starfive — SoC StarFive
  • eswin — SoC Eswin
  • mediatek — SoC MediaTek
  • arm64-mpam — ARM64 MPAM (Memory Partitioning and Monitoring)
  • riscv-iommu — RISC-V IOMMU
  • resctrl — pseudo-FS for resource management
  • nvidia-tegra410-c2c-pmu — NVIDIA Tegra410 C2C PMU
  • nvidia-tegra410-cmem-latency-pmu — NVIDIA Tegra410 PMU
  • rpmsg_virtio — virtio driver for RPM (Remote Processor Messaging)
  • ti-k3-dsp-remoteproc — TI K3 DSP
  • hid-haptic — HID haptic touchpad
  • starfive-wdt — StarFive watchdog

Source: opennet.ru