Red Hat has released the Red Hat Enterprise Linux 10.1 distribution, as well as an update for the previous branch — Red Hat Enterprise Linux 9.7. Ready installation images are available for registered users of the Red Hat Customer Portal (public iso images of CentOS Stream 10 and free RHEL developer builds can be used for functionality evaluation). The release is built for x86_64, s390x (IBM System z), ppc64le (POWER9), Aarch64 (ARM64), and RISC-V (preview) architectures. In accordance with the 14-year support cycle of the RHEL distribution, RHEL 10 will be supported until 2035, with an additional 4 years of extended paid support. Updates for RHEL 9 will continue to be released until the end of May 2032, and for RHEL 8 until 2029.
RHEL packages are not hosted in the public repository git.centos.org and are provided to clients only through a closed section of the website, where a user agreement (EULA) operates that prohibits redistribution of data downloaded through the customer portal, creating legal risks when using these packages to create derivative distributions. The source texts of RHEL remain available in the CentOS Stream repository, but it is not fully synchronized with RHEL and package versions in it do not always match those from RHEL. Rocky Linux, Oracle, and SUSE reproduce the source texts of rpm packages of RHEL releases as part of the OpenELA project.
Key changes in RHEL 10.1 (most of the noted changes are also present in RHEL 9.7):
- All system cryptographic policies (crypto-policies) now include post-quantum encryption algorithms by default. The OpenSSL library has been updated to version 3.5 with support for post-quantum cryptographic algorithms ML-KEM, ML-DSA, and SLH-DSA, support for the QUIC protocol, and the addition of a hybrid variant of ML-KEM to the group of algorithms used by default in TLS. The rpm-sequoia package has added support for OpenPGP v6.
- Support for eDNS (Encrypted DNS) has been added, allowing the use of the DoT (DNS over TLS) protocol to encrypt DNS traffic.
- Support for digital signatures of packages implemented in the RPM6 format has been added. Experimental support for signing RPM packages with digital signatures using the Sequoia PGP toolkit has been provided.
- The RPM package manager now includes the storage of SHA256 and SHA512 checksums for each installed RPM package, ensuring that the installed package matches the specified RPM file.
- systemd now supports soft reboot (the command "systemctl soft-reboot"), which restarts only user space components without affecting the Linux kernel. In this mode, the stages of hardware initialization, bootloader invocation, kernel start and load, driver initialization, firmware loading, and initrd processing are not applied during reboot, significantly speeding up the restart and reducing downtime during updates of environments using ready-made system images. In soft reboot mode, all user space processes are terminated, the root filesystem image is replaced with a new version, and the system initialization process starts without rebooting the kernel.
- The ability to install high-performance computing stacks, such as NVIDIA's CUDA and AMD's ROCm, from repositories supported by Red Hat in collaboration with NVIDIA and AMD has been provided.
- A new AppStream component and the rhel-drivers utility have been added to simplify the installation and updating of third-party drivers for GPUs and AI accelerators. The installation of complicated driver sets from RHEL repositories is supported, such as those covering the NVIDIA kernel module and CUDA libraries. In most cases, to install the necessary drivers, it is now sufficient to execute "dnf install rhel-drivers; rhel-drivers install --auto-detect".
- The Linux kernel has added the fwctl (Firmware Control) subsystem, providing an API for safely managing firmware and executing handlers on firmware side from user space.
- Improvements have been made to the kernel's capabilities regarding system state tracking and power consumption. Support for Intel Panther Lake CPU hardware performance counters has been added. The ability to track power consumption using Intel RAPL (Running Average Power Limit) interface events on systems with Intel Arrow Lake U CPU has been introduced. Support for Intel Trace Hub device identifiers (NPK) on systems with Intel Panther Lake CPU, as well as core and uncore events on systems with Intel Clearwater Forest CPU has been added. Support for collecting power consumption data for each CPU core on systems with AMD Milan CPU has been provided. Debugging capabilities in the python-drgn debugger have been extended.
- The eBPF subsystem has been synchronized with kernel 6.14. The perf toolkit has been synchronized with kernel 6.15.
- The capabilities of the Image Builder tools for creating custom boot images have been expanded. An experimental command-line version of Image Builder, which operates without a GUI, has been added. The ability to create images for the Windows Subsystem for Linux (WSL2) has been implemented. A new type of vagrant-libvirt images has been introduced, and support for libvirt has been added to simplify their launch. of virtual machines with RHEL using the Vagrant tools.
- The systemd services switcheroo-control and tuned-ppd have been switched to SELinux protection. Modules with SELinux policies related to packages from the EPEL repository have been moved to the CRB repository as packages ending in "-extra."
- Support for identifying virtio device types used in guest systems has been added through the lszdev command (previously, all such devices were of the generic-ccw type).
- Modules for the KVM hypervisor have been added to the realtime kernel package (previously, a separate kernel kernel-rt-kvm was built for them).
- The command "rpm" has been added to the installer’s environment. An option "fips=1" has been added to the boot menu of installation images to enable FIPS 140 (Federal Information Processing Standards) compliance mode during the installation phase when generating keys.
- In the NetworkManager network configurator, it is now possible to attach separate IPv4 packet forwarding settings to network interfaces using the "ipv4.forwarding" option. The "prefix-delegation" setting has been introduced, allowing the use of the "subnet-id" property to select the subnet on the downstream network interface when using IPv6 prefix delegation. The nmtui utility has been enhanced to support configuring the loopback interface.
- The PostGIS extension has been added for the PostgreSQL database.
- The functions sched_setattr and sched_getattr have been relocated into Glibc, through which task scheduler parameters can be set/read. In practice, these functions allow configuring scheduling policies for requests, such as SCHED_DEADLINE, which use additional parameters beyond priority.
- Full support for HSM (Hardware Security Modules) has been added to IdM. The ability to use the ipa-migrate command to transfer all IdM data, such as sudo rules, HBAC, DNA ranges, host lists, and services from one IdM server to another has been declared stable.
- SSSD has improved authentication using smart cards in environments with multiple connected PKCS#11 tokens. An ldap_read_rootdse option has been added to control how SSSD reads the contents of RootDSE (Root Directory Service Entry).
- Toolbx containers created from UBI images now support OpenGL and Vulkan out of the box without requiring manual installation of the associated Mesa API components.
- Support for live snapshots, 'Pre-copy', 'Post-copy', and 'Multi-FD' migration modes, as well as live migration with virtiofs, has been implemented for virtual machines running on ARM64 architecture host systems.
- Direct kernel boot support has been added for virtual machines configured to operate in SecureBoot mode.
- Support for reproducible container builds has been improved. New container images rhel10/valkey-8, rhel10/nodejs-24, and rhel10/nodejs-24-minimal have been added with pre-configured Valkey databases and the Node.js platform.
- Experimental support for the ReaR (Relax-and-Recover) tooling and the Confidential Compute Architecture (CCA) has been provided for ARM64 systems in virtual machines.
- An experimental version of the vDPA (virtio Data Path Acceleration) device has been implemented in user space using the VDUSE framework. VDUSE allows the creation of virtual block devices in user space and applies Virtio as the transport for access from guest systems.
- An experimental feature using the Virtual Socket (vsock) mechanism for TCP bridging has been realized, enabling network services like SSH to operate in virtual machines without network configuration (direct connection forwarding from the host environment to the service through vsock).
- FTP clients and servers: ftp, lftp, and vsftpd have been declared deprecated. The ipset utility has been downgraded to unsupported status and is scheduled for removal.
- New drivers have been added:
- intel_vpu for Intel NPU (Neural Processing Unit),
- tuner for various TV tuner models,
- btmtk for MediaTek Bluetooth chips,
- tpm_svsm for SNP SVSM vTPM (virtual Trusted Platform Module),
- ae4dma for AMD AE4DMA,
- ptdma for AMD PassThru DMA,
- ch7006 for Chrontel ch7006 TV encoder,
- cirrus-qemu for Cirrus Logic graphics card emulation,
- drm_gpusvm for DRM GPUSVM,
- hid-corsair-void for Corsair Void headsets,
- intel-thc for Intel Touch Host Controller,
- intel-quicki2c for Intel QuickI2C,
- intel-quickspi for Intel QuickSPI,
- cx231xx for Conexant cx231xx USB video card,
- cx25840 for Conexant CX25840 audio/video decoder,
- as21xxx for Aeonsemi AS21xxx network cards,
- iwlmld for Intel MLD wireless devices.
- mxl-86110 for MaxLinear MXL86110 network cards,
- microchip_rds_ptp for Microchip PHY RDS PTP,
- realtek for Realtek network cards,
- gs_usb for USB interfaces for the CAN bus from Geschwister Schneider and candleLight,
- amd_3d_vcache — AMD 3D V-Cache Performance Optimizer.
- Updated package versions for developers: GCC 14.3, GCC Toolset 15.1, Node.js 24, .NET 10.0, LLVM Toolset 20.1.8, Rust Toolset 1.88.0, OpenJDK 25, Go Toolset 1.24, GDB 16.3, Valgrind 3.25.1, SystemTap 5.3.
- Updated server packages: Apache HTTPD 2.4.63, libreswan 5.3, iproute 6.14.0, samba 4.22.4, 389-ds-base 3.1.3, postfix 3.8.5, Podman 5.6.
- Updated system packages: glibc 2.39, binutils 2.41, OpenSSL 3.5, NSS 3.112, GnuTLS 3.8.10.
Source: opennet.ru
