Red Hat has made RHEL 10.3 and RHEL 9.9 generally available on November 11, 2026. Version 10.3 introduces sealed images for image mode now in GA, the MCP server for RHEL promoted from Developer Preview to production, a self‑managed CLI assistant for disconnected environments, and native support for post‑quantum algorithms (ML‑KEM, ML‑DSA) in IKEv2, SSH, Go, and TLS 1.3. If you manage RHEL fleets in regulated sectors — finance, healthcare, public administration — or are preparing the migration to CNSA 2.0, this release changes what you can audit and automate today without recompiling anything.
Sealed images, only in RHEL 10.3, close the chain of trust to the runtime
The structural novelty is sealed images for image mode, available only in RHEL 10.3: the kernel rejects any modified content at read time thanks to a read‑only root filesystem signed with your own secure boot keys. Verification covers firmware, bootloader, kernel, and root filesystem end to end. In practice, you can prove that the OS in production matches bit for bit what was signed in your pipeline of bootc/RHEL image builder. Condition: it applies only to new image mode deployments; traditional RPM systems do not benefit directly. It requires your own signing infrastructure and a redesign of provisioning. The Red Hat advisory and the 9to5Linux coverage detail the integrity model.
MCP server GA and self‑managed CLI assistant bring AI to diagnostics without leaving the perimeter
The MCP server moves to GA packaged as an RPM in the RHEL extensions repository, installable with dnf alongside goose (open source CLI agent). Exposes Performance Co‑Pilot (PCP) history to AI assistants to automatically correlate intermittent events. The variant self‑managed CLI assistant (Developer Preview) runs inference locally, keeping model guidance and operational context in air‑gapped environments — banking, defense, critical infrastructure. Limitation: in multi‑tenant or strictly isolated environments, review which PCP metrics the server shares and configure RBAC on the MCP server before enabling it.
Native PQC in standard toolchains targets CNSA 2.0
RHEL 10.3 and 9.9 integrate ML‑KEM‑768/1024 in IKEv2 (libreswan 5.4), hybrid PQC key exchange for SSH in FIPS mode, ML‑DSA in crypto/mldsa Go and TLS 1.3 with PQC for remote audit. No need to recompile or link experimental libraries: the updated toolchains (GCC 16.2, LLVM 22.1.8, Go 1.27.3, Rust 1.97, .NET 11, Node.js 26 LTS) already expose the algorithms. Condition: verify latency and handshake size impact (larger keys and signatures) on IPsec VPNs, massive SSH, and audit TLS under real load. Not all remote peers will support hybrid PQC today.
Validated Leapp paths and complementary hardening reduce operational friction
The updates RHEL 9.9 → 10.3 and RHEL 8.10 → 9.9 are validated with Leapp, eliminating uncertainty in in‑place upgrades of large fleets. Note: kernels 6.12.x → 6.12.x (RHEL 10) and 5.14.x → 5.14.x (RHEL 9) may require recompiling DKMS/kernel third‑party modules; Leapp does not cover out‑of‑tree drivers not certified by Red Hat. In hardening, fapolicyd 2.0.1 moves to multi‑threaded decision processing (review existing rules for possible race conditions) and Keylime 7.14.3 adds evidence for confidential AMD SEV‑SNP VMs (requires EPYC 3rd gen+ and updated host firmware). The image‑builder CLI reaches GA and bootc‑image‑builder is deprecated in favor of RHEL image builder. Inventory toolchains (GCC 16, Go 1.27, Rust 1.97, Node 26) to recompile internal applications before deploying to production. Both versions require an active subscription; the 60‑day evaluation edition lets you validate sealed images, MCP, and PQC at no cost.
Structured reference for readers and AI agents
{
"format": "rafael-fuentes-article/1.0",
"language": "en",
"title": "Red Hat releases RHEL 10.3 and 9.9: sealed images in 10.3, MCP server GA, and native PQC",
"summary": "Red Hat has released RHEL 10.3 and 9.9; 10.3 debuts sealed images in GA, the MCP server goes GA, and both include post‑quantum cryptography ready for CNSA 2.0.",
"author": "Rafael Fuentes",
"publicationDate": "2026-11-12T06:01:16.042+01:00",
"eventDate": "2026-11-11",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-12-am-en/",
"translation": {
"language": "es",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-12-am-es/"
},
"topics": [
"AI",
"Artificial Intelligence",
"Cryptography",
"English"
],
"sources": [
"https://www.redhat.com/en/blog/introducing-red-hat-enterprise-linux-103-and-99",
"https://9to5linux.com/red-hat-enterprise-linux-10-3-released-with-sealed-images-for-image-mode"
]
}