Release of Red Hat Enterprise Linux 10.2

Red Hat has released version 10.2 of its Red Hat Enterprise Linux distribution, along with an update to the previous branch — Red Hat Enterprise Linux 9.8. Ready installation images are available for registered users on the Red Hat Customer Portal (public ISO images of CentOS Stream 10 and free RHEL developer builds can be used for functional assessment). The release is available for x86_64, s390x (IBM System z), ppc64le (POWER9), Aarch64 (ARM64), and RISC-V (preview) architectures. Updates for the RHEL 10.2 release will be provided until May 2032. The RHEL 10 branch will be supported until 2035 (+ 4 years of extended paid support), RHEL 9 until the end of May 2032, and RHEL 8 until 2029.

RHEL packages are not hosted in the public repository git.centos.org and are provided to clients only through a closed section of the website, where a user agreement (EULA) operates that prohibits redistribution of data downloaded through the customer portal, creating legal risks when using these packages to create derivative distributions. The source texts of RHEL remain available in the CentOS Stream repository, but it is not fully synchronized with RHEL and package versions in it do not always match those from RHEL. Rocky Linux, Oracle, and SUSE reproduce the source texts of rpm packages of RHEL releases as part of the OpenELA project.

Key changes in RHEL 10.2 (most of the noted changes are also present in RHEL 9.8):

• The io_uring interface has been made available for asynchronous input/output operations.
• Support for the WiFi 7 standard has been added.
• An option to use the AI assistant goose in the command line has been introduced. Packages with goose are available through the 'extensions' repository.
• The Anaconda installer has added the capability for automatic installation of Flatpak packages during the distribution installation process. The availability of Flatpak packages depends on the selected environment; for example, choosing 'Server with GUI' installs a Flatpak package with Firefox.
• A new 'rdp' command has been added in Kickstart to enable graphical installation using the RDP (Remote Desktop Protocol), as well as an experimental (Technology Preview) 'bootc' command for deploying boot containers.
• The graphical interface for creating system images (image builder) has been updated to support the creation of bootable containers and disk images, as well as network installation images with the Anaconda installer.
• A new command "bootc upgrade —download-only" has been added to download system updates based on bootc without applying them automatically. The command "bootc upgrade" can be used to apply previously downloaded updates.
• The ability to convert boot images of containers into virtual machines. For launching such ephemeral of virtual machines a utility named bcvk has been proposed.
• Support has been added for creating network boot images via PXE that do not change their state (stateless builds for diskless systems) from existing container builds.
• OpenSSH and libssh now support hybrid key exchange algorithms
  mlkem768nistp256-sha256 and mlkem1024nistp384-sha38, resistant to quantum computer attacks. Support for keys and digital signatures based on the ML-DSA algorithm has been implemented in the PKI and certificate system.
• The systemd-oomd and redfish-finder services have been put under SELinux protection. The SELinux contexts for anaconda_generator_t, ktlshd_t, switcheroo_control_t, systemd_pcrextend_t, systemd_user_runtimedir_t, and tuned_ppd_t have switched from "permissive" to "enforcing". SELinux settings have been adapted for the new OpenSSH processes — sshd-session and sshd-auth.
  SELinux now supports the DCCP (Datagram Congestion Control Protocol) and SCTP (Stream Control Transmission Protocol) network protocols.
• A new package "capnproto" has been added to the CRB (CodeReady Builder) repository, featuring Cap’n Proto, a high-performance data interchange and remote procedure call (RPC) system, which is used in the rust-sequoia package.
• A new implementation of the client and server FIDO Device Onboarding (FDO) go-fdo-client and go-fdo-server has been proposed.
• A new package greenboot-rs has been added, implementing the Greenboot toolkit rewritten in Rust (the old version was written in bash). Greenboot is used in atomically updatable versions of RHEL to check system status during boot and roll back to a previous version if issues are detected.
• Support for using the Nmstate API and the NetworkManager-libreswan plugin for configuring multiple subnet bindings via a single IPsec tunnel has been added. NetworkManager-libreswan now supports on-demand initiation of IPsec connections based on Libreswan.
• The API epoll implements IRQ suspension mode, adaptively switching between active polling (NAPI/busy polling, periodic polling of the device by the kernel) and interrupt generation depending on periods of application activity. When the application is idle, interrupt handling is used, while high load triggers polling. In some situations, this new mode can reduce energy consumption in data centers by up to 30%.
• Full support for PRP (Parallel Redundancy Protocol) and HSR (High-availability Seamless Redundancy) protocols has been implemented through the hsr kernel module.
• The Linux kernel has implemented the command line option 'microcode=flag list' to control the behavior of the microcode loader on x86 systems (for example, to specify the minimum acceptable microcode version for booting).
• In nftables, support for masks in network interface names has been added in netdev handlers, for example, 'type filter hook ingress devices = { "vlan*", "veth0" }'.
• The iproute package has added the dpll utility for managing and monitoring DPLL (digital phase-locked loop) devices.
• The kernel-modules-extra package now includes kernel modules.
  Fou and fou6 are included with the implementation of FOU (Foo-over-UDP) and GUE (Generic Routing Encapsulation) protocols for tunneling various IP protocols over UDP.
• FirewallD has added support for predefined rule sets (policy-sets). For example, the 'gateway' rule set encompasses the functionality of a typical home router (including NAT, conntrack handlers, and traffic redirection between zones).
• The ability to save kernel memory dumps (vmcore) to LUKS encrypted partitions after crashes has been added.
• The tpm2-tools package has improved compatibility with new TPM 2.0 (Trusted Platform Module) chips.
• The BPF subsystem has been synchronized with kernel 6.17, and Perf with kernel 6.18. Support for performance tracking on systems with Fujitsu Monaka and Intel Clearwater Forest CPUs has been added.
• In ftrace, the ability to use the function_graph tracer to track return values from functions has been added.
• The kpatch utility, used for applying patches to the kernel without stopping the system, has added the capability to view a list of CVE identifiers for vulnerabilities fixed in the active kernel.
• Support for the Persistent Reservations mechanism has been implemented for LVM volume groups (VG), allowing the reservation of areas in shared storage.
• System Roles can now be applied to atomically updated systems created using various tools, including ostree. This change allows for the deployment and configuration of atomically updated systems using the same roles that are used for regular systems.
• The virtio-win package has added a viosock (Virtual Socket) driver for Windows virtual machines, enabling interaction between guest and host systems. A service called virt-secrets-init-encryption has also been added for encrypting access keys used in libvirt for vTPM (virtual Trusted Platform Module).
• QEMU has implemented native (non-emulated) use of the FUA (Forced Unit Access) I/O method, resulting in improved performance for virtual storage, particularly under database-like workloads.
• The Podman toolkit has been transitioned from GnuPG to Sequoia-PGP, an OpenPGP implementation written in Rust. Support for creating digital signatures for containers using Sequoia-PGP has been provided.
• New containers rhel10/ruby-40, rhel10/postgresql-18, rhel10/python-314-minimal, rhel10/mariadb-118, and rhel10/php-84 have been added to the Red Hat Container Registry.
• An experimental feature for booting virtual machines in Secure Boot mode on ARM64 systems has been added.
• Experimental support for live migration of virtual machines using the S3-PR (SCSI3-Persistent Reservation) protocol has been added.
• Experimental support for running containers in lightweight microVMs using the krun runtime (based on crun) has been added.
• An experimental feature allowing the use of vsock (Virtual Socket) for redirecting access to TCP ports from the host environment to the guest system without additional configurations, such as redirecting access to SSH, has been introduced.
• The vi command has been switched to run vim-minimal instead of the full Vim editor.
• The default size of the /boot partition has been increased from 1 to 2 GB.
• Support has been added for servers with Intel Xeon 6+ processors (CWF, Clearwater Forest). Support for Intel QAT (QuickAssist Technology) Gen6 hardware accelerators has been introduced. Stable support for IAA (In-Memory Analytics Accelerator) accelerators built into Intel Wildcat Lake CPUs has been announced.
• New drivers have been added:
  • qaic — for Qualcomm Cloud AI accelerators.
  • tpm_crb_ffa — for the TPM CRB FFA driver.
  • qat_6xxx for Intel QuickAssist Technology GEN6 crypto accelerators.
  • imx-bus for Generic i.MX bus.
  • imx8m-ddrc for managing the frequency of the i.MX8M DDR controller.
  • zl3073x for Microchip ZL3073x DPLL (Digital Phase Locked Loop).
  • gpio-usbio for Intel USBIO GPIO.
  • sil164 for Silicon Image sil164 TMDS.
  • mshv_root for Microsoft Hyper-V root partition VMM.
  • gpio_keys for connecting a keyboard via GPIO.
  • mtd_intel_dg for Intel DGFX MTD.
  • rtw89_8922a for Realtek 802.11be wireless 8922A.
  • amd_hsmp for AMD HSMP (Host System Management Port).
  • amd_isp4 for AMD ISP4 (Image Signal Processor).
  • intel-oaktrail for Intel Oaktrail.
  • intel-sdsi for Intel On Demand (SDSi).
  • typec_thunderbolt for Thunderbolt 3 USB Type-C.
  • usbio for Intel USBIO.
• Updated package versions for developers: Python 3.14, Ruby 4.0, PHP 8.4, OpenJDK 25, LLVM Toolset 21, Go Toolset 1.26, Rust Toolset 1.92, Git 2.51, PostgreSQL 18, MariaDB 11.8, valgrind 3.26.0,
  SystemTap 5.4, Node.js 24.
• Updated server packages: NetworkManager 1.56.0, BIND 9.18.33, openwsman 2.8.1, iproute 6.17.0, nftables 1.1.5, OpenSSH 9.9, libreswan 5.3, chrony 4.8, podman 5.8.0, libvirt 11.10.0, QEMU 10.1.0,
  Samba 4.23.5, ipa 4.13.0, 389-ds-base 3.2.0, cockpit 356.
• Updated system packages: chrony 4.8,
  setools 4.6.0, fapolicyd 1.4.3, libssh 0.12.0, OpenSCAP 1.4.3, librepo 1.19.0, rsyslog 8.2510.0, OpenSSL 3.5.5, Cockpit 356, cmake 3.31.8, sudo 1.9.17p2, fwupd 2.0.19.
• The desktop environment has been updated to GNOME 49 (was GNOME 47). An experimental HDR (High Dynamic Range) mode has been added to the compositor Mutter for displays that support broader brightness ranges.
  Updated Mesa 25.2.7, libinput 1.30, and PipeWire 1.4.9.
• The GDM login screen now features experimental support for interactive selection of authentication methods, including the use of external identity provider (EIdP), FIDO2-compatible devices, and smart cards.
• Firefox and Thunderbird are now delivered in Flatpak format.

Source: opennet.ru