What’s New in RHEL 10.2 and 9.8

Red Hat shipped RHEL 10.2 and RHEL 9.8 on 20 May 2026, the latest minor releases on the two active Red Hat Enterprise Linux lines. RHEL 10 stays on the feature-evolving track with kernel 6.12, a Wayland-only desktop, and image mode, while 9.8 backports the portable pieces (post-quantum crypto libraries, new database and language streams, the command-line AI assistant) to the platform most production fleets still run. This guide walks through what actually changed, with the version numbers checked on a registered RHEL 10.2 system in June 2026 rather than copied from the announcement.

What is new in RHEL 10.2 and 9.8

Both releases share a theme Red Hat calls “intelligent evolution,” and most of the headline items land in both 10.2 and 9.8:

• Color-coded AI assistant output: the command-line assistant powered by RHEL Lightspeed now separates commands and scripts from explanatory text in its answers.
• goose, the optional AI agent: a new agent client lands in the Extensions repository, wired to the same Lightspeed backend, for multi-step tasks and tool use.
• Post-quantum cryptography: ML-KEM key encapsulation and ML-DSA signatures are available across OpenSSL, GnuTLS, NSS, and OpenSSH to defend against “harvest now, decrypt later.”
• Fresh database and language streams: PostgreSQL 18, Python 3.14, and LLVM Toolset 21 are available as application streams.
• Single-command in-place upgrade: Leapp now performs the 9-to-10 conversion and major-version upgrade in one step, with Ansible Certified content automating common pre-upgrade fixes.
• Image mode controls (RHEL 10): bootc upgrade --download-only pre-stages updates without applying them, and sealed images (Technology Preview) let you sign builds with your own keys.

The command-line AI assistant

The marquee feature of the RHEL 10 line is the RHEL Lightspeed command-line assistant. You install the command-line-assistant package, then ask questions in plain English with the c command. A small daemon called clad forwards the question to Red Hat’s Lightspeed service, which is trained on Red Hat documentation and the Knowledgebase and is included with every subscription. The 10.2 and 9.8 update adds the color-coded output, and a separate goose agent in the Extensions repo talks to the same backend for tasks that need more than a single answer.

It works on RHEL 10.0 and later and RHEL 9.6 and later, and there is a developer-preview build that runs a local model for disconnected systems. The full setup, including piping logs into a question, attaching files, the goose agent, and the offline model, is covered in the hands-on guide to the RHEL command-line AI assistant.

Verified component versions on RHEL 10.2

RHEL 10.2 carries the codename Coughlan. These are the core versions confirmed on a fresh, registered 10.2 install, not the launch-blog numbers:

The table below compares the two releases. RHEL 10 keeps moving its base toolchain forward, while 9.8 backports the portable streams and security libraries but stays on the long-lived 5.14 kernel:

Note the difference between base and stream versions. The default postgresql-server on RHEL 10.2 is still 16, with 18 available as a separate stream, and the base system compiler is GCC 14 even though GCC Toolset 15 ships as an add-on. Always check what a stream provides with dnf info before pinning a version in automation.

Security: post-quantum cryptography and more

The security story this cycle is dominated by post-quantum cryptography, and it is no longer just a slideware promise. On a 10.2 box, SSH already offers ML-KEM hybrid key exchange, and OpenSSL lists the full ML-KEM and ML-DSA family:

Beyond the quantum-resistant algorithms, the security changes worth knowing are:

• OpenSSH is at 9.9p1, a large jump from the 8.7 that RHEL 9 originally shipped.
• RHEL 9.8 pulls in GnuTLS 3.8.10 for the same ML-KEM and ML-DSA support, so post-quantum work is not gated on moving to RHEL 10.
• A sudo system role manages sudoers consistently across a fleet, and the Sequoia PGP tools (sq and sqv) ship as a modern alternative to GnuPG.
• SELinux remains in enforcing mode by default, with sandbox support extended to Wayland sessions.
• Image mode supports FIPS, so a bootc-built image can meet the same compliance bar as a package-mode install.

Image mode and containers

Image mode, where the operating system is built and shipped as a bootc container image, is where RHEL 10 invests most heavily. The 10.2 additions are practical for fleet operators:

• Download-only updates: bootc upgrade --download-only pre-stages an update so you can validate it and apply it inside a maintenance window instead of on the next reboot.
• Sealed images (Technology Preview): sign images with your own Secure Boot keys so a host only trusts internally certified builds.
• bcvk: a Bootable Containers and Virtualization Kit tool for spinning up ephemeral VMs straight from a bootc image.
• Container tools: Podman is at 5.8.2, refreshed as a rolling application stream, and the Red Hat build of Podman Desktop is now available for RHEL 9 and 10 through the Extensions repo.
• Image builder: bootc-image-builder can target VMware (VMDK) and Google Cloud, and supports multi-architecture builds.

Desktop, web console, and system roles

RHEL 10.2 rebases the desktop to GNOME 49.4, and the desktop session is Wayland-only. The web console (Cockpit) keeps the file browser added earlier in the 10 line, so you can browse, upload, and manage files from a tab. On the automation side, RHEL system roles gained an aide role for file-integrity monitoring and a sudo role for sudoers management, while the storage and snapshot roles picked up LVM thin-pool and Stratis handling. If you manage RHEL with Ansible already, these roles fold straight into existing playbooks.

What is specifically new in RHEL 9.8

Most production servers still run RHEL 9, so 9.8 matters even though it shares headlines with 10.2. The release-specific additions are:

• PostgreSQL 18 lands as the postgresql:18 module stream, alongside Python 3.14 and LLVM Toolset 21.
• GnuTLS 3.8.10, OpenSSH 9.9, and an updated p11-kit bring the same post-quantum algorithms RHEL 10 has.
• kdump can write its vmcore to a LUKS-encrypted volume, and perf gains enhanced AMD Instruction-Based Sampling.
• The single-command Leapp upgrade applies here too, lowering the cost of the eventual move to RHEL 10.

One piece of context shapes how you should read 9.8: RHEL 9 leaves Full Support on 31 May 2027 and enters Maintenance Support until 2032. That makes 9.8 one of the last full-feature minor releases on the 9 line, so if you are planning a major-version move, this is the time to start testing it rather than waiting for the support clock to run down.

Lifecycle and upgrade decisions

The dates drive most upgrade decisions, so it helps to see them together:

Those EOL dates are the standard Maintenance Support end. A paid Extended Life Cycle Support add-on pushes each out by roughly three more years. For an in-place move, Leapp now folds the conversion and the major upgrade into one run. The RHEL 9 to RHEL 10 path is supported on x86-64-v3, ARMv8.0-A, IBM Power9 little-endian, and IBM Z (z14). There is still no direct RHEL 8 to RHEL 10 jump, so an 8-era host upgrades to 9 first, then to 10.

sudo dnf install -y leapp-upgrade
sudo leapp preupgrade
sudo leapp upgrade

Run leapp preupgrade first and clear every inhibitor it reports before starting the actual upgrade. The Ansible Certified content new in this cycle automates a good share of those pre-upgrade fixes.

Removed and deprecated in RHEL 10

If you are coming from RHEL 9, a handful of removals will change muscle memory:

• The X.Org Server is deprecated; the desktop is Wayland-only, with Xwayland for legacy X applications.
• GNOME Terminal is replaced by Ptyxis, and PulseAudio by PipeWire.
• LibreOffice is no longer in the repos and installs from the Flathub Flatpak.
• The dhcp-client package is gone; use the NetworkManager internal DHCP client.
• TigerVNC is replaced by the gnome-remote-desktop daemon, and the installer uses RDP rather than VNC for graphical remote access.
• The auth and authconfig Kickstart commands are removed in favor of authselect, and new devices default to LUKS2.

The official 10.2 release notes carry the complete removal and deprecation list.

Should you move to 10.2 or stay on 9.8

If you are starting fresh or want the longest runway, RHEL 10.2 is the right target: a newer kernel, image mode, the rebased toolchain, and support out to roughly 2035. If you run a fleet that is happy on RHEL 9, 9.8 keeps you current on the security work that matters most, including the post-quantum libraries and the new database and language streams, without a kernel jump. Either way, RHEL 9’s Full Support ending in May 2027 is the deadline to plan against, and the single-command Leapp upgrade makes the eventual move cheaper than it used to be. When you are ready to build a box, the step-by-step RHEL 10 installation guide covers it from ISO to first boot, and the command-line AI assistant is worth setting up on day one.