SupportConsoleDevelopersStart a trialContact

Chapter 12. Fixed issues

Review issues that have been fixed in Red Hat Enterprise Linux 10.0.

12.1. Installer and image creation
Copy link

Review issues that have been fixed for installer and image creation in Red Hat Enterprise Linux 10.0.

Improved installation program stability during virtual network devices configuration
Previously, the installation program could crash when creating a VLAN network device over an existing virtual network device (for example, Team or Bond) in the GUI. This occurred when the underlying device’s state changed during the configuration update to the user interface for the new device state.

With this update, the process of refreshing the state of networking in GUI optimized to handle changes in the virtual device state. As a result, the installation program no longer crashes due to changes regarding virtual network devices configured in GUI.

Jira:RHEL-56141

12.2. Security
Copy link

Review issues that have been fixed for security in Red Hat Enterprise Linux 10.0.

IPsec ondemand connections no longer fail to establish
Previously, when an IPsec connection with the ondemand option was configured by using the TCP protocol, the connection failed to establish. With this update, the new Libreswan package makes sure that the initial IKE negotiation completes over TCP. As a result, Libreswan successfully establishes the connection even in TCP mode of IKE negotiation.

Jira:RHEL-51880[1]

NSS now enforce EMS in FIPS mode
The Network Security Services (NSS) libraries now contain the TLS-REQUIRE-EMS keyword to require the Extended Master Secret (EMS) extension (RFC 7627) for all TLS 1.2 connections as mandated by the FIPS 140-3 standard. NSS use the new keyword when the system-wide cryptographic policies are set to FIPS.

If your scenario requires interoperating with legacy systems without support for EMS or TLS 1.3, you can apply the NO-ENFORCE-EMS system-wide cryptographic subpolicy. However, this change violates the FIPS-140-3 requirements.

Jira:RHEL-36299

shlibsign now works in FIPS mode
Before this update, the shlibsign program did not work in FIPS mode. Consequently, when you rebuilt an NSS library in FIPS mode, you had to leave FIPS mode to sign the library. The program has been fixed, and you can now use shlibsign in FIPS mode.

Jira:RHEL-61291[1]

OpenSSL cipher suites no longer enable cipher suites with disabled hashes or MACs
Previously, applying custom cryptographic policies could leave certain TLS 1.3 cipher suites enabled even if their hashes or MACs were disabled, because the OpenSSL TLS 1.3-specific Ciphersuites option values were controlled only by the ciphers option of the cryptographic policy. With this update, crypto-policies takes more algorithms into account when deciding whether to enable a cipher suite. As a result, OpenSSL on systems with custom cryptographic policies might refuse to negotiate some of the previously enabled TLS 1.3 cipher suites in better accordance with the system configuration.

Jira:RHEL-76526

update-ca-trust extract no longer fails to extract certificates with long names
When extracting certificates from the truststore, the trust tool internally derives the file name from the certificates' object label. For long enough labels, the resulting path might previously have exceeded the system’s maximum file name length. As a consequence, the trust tool failed to create a file with a name that exceeded the maximum file name length of a system. With this update, the derived name is always truncated to within 255 characters. As a result, file creation does not fail when the object label of a certificate is too long.

Jira:RHEL-64915[1]

Binary tests for libcap are waived
The annocheck tool discovered binary packages in the libcap library function that were built without the required flags for RHEL 10 architectures. We examined the flags for potential problems and did not find any. After careful investigation, we have waived the results for libcap. As a result, all tests for libcap passed.

Jira:RHEL-33498[1]

NSS database password updates no longer corrupt ML-DSA seeds
Before this update, when you changed the database password, a bug in how NSS handled database re-encryption prevented the ML-DSA seed attribute from updating. As a result, the seed value was permanently lost, even if you knew the previous password. With the release of the RHBA-2026:3809 advisory, password changes correctly update the ML-DSA seed attribute and no longer cause the permanent loss of seed values. Note that you still cannot recover the seeds lost before this update.

Jira:RHEL-127673[1]

12.3. Software management
Copy link

Review issues that have been fixed for software management in Red Hat Enterprise Linux 10.0.

The dnf remove-n command removes only packages with the matching RPM names
Previously, if you installed some package and another package that had the name of the former package in the RPM Provides directive, a first invocation of the dnf remove-n command removed the former package. A repeated invocation of the command removed the latter package.

With this update, the dnf remove-n command removes only packages with matching RPM names and does not consider the RPM Provides. As a result, only one invocation of dnf remove-n is sufficient to remove all matching packages.

Jira:RHEL-5747

The dnf remove --duplicates command no longer exits with non-zero exit code and error message
Previously, if you ran the dnf remove --duplicates command when no duplicate packages were present on the system, dnf exited with non-zero exit code and the No duplicated packages found for removal. error on standard error output (stderr). With the update, dnf exits with 0 and does not write anything on stderr. Note that the same issue was also fixed for the dnf remove --oldinstallonly command when no older versions of installonly packages are installed.

Jira:RHEL-37552

12.4. Shells and command-line tools
Copy link

Review issues that have been fixed for shells and command-line tools in Red Hat Enterprise Linux 10.0.

ReaR now interprets square brackets enclosing IPv6 addresses in URLs as expected
Previously, square brackets in OUTPUT_URL and BACKUP_URL were not interpreted correctly. Specifying an IPv6 address instead of a hostname requires enclosing the address in square brackets, for example, [::1] for localhost. Since the brackets were not interpreted correctly, using an IPv6 address in a sshfs:// or nfs:// URL was not possible.

As a consequence, if the user used a sshfs:// or nfs:// scheme in the BACKUP_URL or OUTPUT_URL with an IPv6 address enclosed in square brackets, ReaR aborted prematurely with an error message, for example: 

ERROR: Invalid scheme '' in BACKUP_URL

With this update, ReaR is now fixed to not interpret square brackets as shell metacharacters when parsing sshfs:// and nfs:// URLs. Now, you can use IPv6 addresses enclosed in brackets in BACKUP_URL and OUTPUT_URL that use the sshfs:// or nfs:// scheme . For example: 

OUTPUT_URL=nfs://[2001:db8:ca2:6::101]/root/REAR

Before this fix was implemented, it was possible to work around the bug by using quoting and backslash characters, for example: 

OUTPUT_URL="nfs://\[2001:db8:ca2:6::101\]/root/REAR"

Note: If you have been using the workaround, remove the backslash characters after applying the update.

Jira:RHEL-46613[1]

12.5. Infrastructure services
Copy link

Review issues that have been fixed for infrastructure services in Red Hat Enterprise Linux 10.0.

cups-filters project is now split into several projects

The cups-filters project is split into several projects . The notable packages are mentioned below :

  • libcupsfilters: replacement for cups-filters-libs RPM.
  • libppd PPD library for retrofitting PPD support is added as a new component.
  • cups-browsed: the daemon which was previously shipped in cups-filters.
  • cups-filters: filters needed for various printing.
  • cups-filters-driverless: ships driver less utilities, split from cups-filters to prevent additional dependencies for customers, who do not want to use the driver less utilities.

The customers who have disabled weak dependencies will not receive the cups-browsed and cups-filters-driverless packages, as they are weak dependencies of CUPS in RHEL 10. The cups-browsed package is part of the Server comps data and is installed by default in Server variants.

Jira:RHELDOCS-17679[1]

12.6. Networking
Copy link

Review issues that have been fixed for networking in Red Hat Enterprise Linux 10.0.

NetworkManager can mitigate the impact of CVE-2024-3661 (TunnelVision) in VPN connection profiles
VPN connections rely on routes to redirect traffic through a tunnel. However, if a DHCP server uses the classless static route option (121) to add routes to a client’s routing table, and the routes propagated by the DHCP server overlap with the VPN, traffic can be transmitted through the physical interface instead of the VPN. CVE-2024-3661 describes this vulnerability, which is also know as TunnelVision. As a consequence, an attacker can access traffic that the user expects to be protected by the VPN.

On RHEL, this problem affects LibreSwan IPSec and WireGuard VPN connections. Only LibreSwan IPSec connections with profiles in which both the ipsec-interface and vt-interface properties are undefined or set to no are not affected.

The CVE-2024-3661 document describes steps to mitigate the impact of TunnelVision by configuring VPN connection profiles to place the VPN routes in a dedicated routing table with a high priority. The steps work for both LibreSwan IPSec and WireGuard connections.

Jira:RHEL-64719[1]

RHEL 10 provides libnftnl version 1.2.8

The libnftnl library version 1.2.8 provides a few bug fixes. Notable changes include:

  • Fixes incorrect validation of the dynset Netlink attribute from the kernel.
  • No longer appends a newline when printing a rule.

Jira:RHEL-66276

12.7. Boot loader
Copy link

Review issues that have been fixed for networking in Red Hat Enterprise Linux 10.0.

The GRUB2 net_del_dns command deletes the DNS server correctly
Previously, if you attempted to delete the DNS server by using the net_del_dns command, it added the DNS server back erroneously because of incorrect implementation, and returned an error. With this fix, the add command was replaced by the remove command in the net_del_dns implementation. As a result, you can delete the DNS server by using the net_del_dns command.

Jira:RHEL-4378

12.8. File systems and storage
Copy link

Review issues that have been fixed for file systems and storage in Red Hat Enterprise Linux 10.0.

The Kickstart file now correctly sets the required device size for installation when using LVM partitioning with LUKS
Before this update, when you specified the --size=1 --grow --encrypted option in the Kickstart file for a new device, the installation program failed to correctly expand the encrypted device to a valid size. Consequently, the automated installation stopped with an error message, for example: 
"Kickstart insufficient" "('device cannot be smaller than 16 MiB', 'luks5'

You would then have to proceed with manual installation without the Kickstart file.

With this update, the installation starts successfully with the device specified in the Kickstart file with --size=1 --grow --encrypted. As a result, the installation proceeds without errors.

Jira:RHEL-45180

multipathd no longer crashes because of errors encountered by the ontap prioritizer
Before this update, multipathd crashed when it was configured to use the ontap prioritizer on an unsupported path, because the prioritizer only works with NetApp storage arrays. This failure occurred due to a bug in the prioritizer’s error logging code, which caused it to overflow the error message buffer. With this update, the error logging code has been fixed, and multipathd no longer crashes because of errors encountered by the ontap prioritizer.

Jira:RHEL-49747[1]

Native NVMe multipathing no longer causes a memory leak when enable_foreign is set to monitor natively multipathed NVMe devices
Before this update, enabling native NVMe multipathing caused a memory leak if the enable_foreign configuration parameter was set to monitor natively multipathed NVMe devices. With this update, the memory leak was fixed in multipathd monitoring code. As a result, multipathd can now monitor natively multipathed NVMe devices without increasing memory usage.

Jira:RHEL-73410[1]

RHEL installation program now discovers and uses iSCSI devices as boot devices on aarch64
Previously, the absence of the iscsi_ibft kernel module in RHEL installation programs running on aarch64 prevented the automatic discovery of iSCSI devices defined in firmware. As a result, these devices were not automatically visible nor selectable as boot devices in the installation program during manual addition GUI.

This issue has been resolved by including the iscsi_ibft kernel module in newer aarch64 builds of RHEL. As a result, the iSCSI devices are now automatically detected and available as boot options during installation.

Jira:RHEL-75491[1]

fstrim enabled by default on LUKS2 root in ostree-based new installations done by Anaconda
Previously, installing ostree-based systems, such as Image Mode, by using ostreesetup or ostreecontainer Kickstart commands with LUKS2 encryption enabled on the / (root) mount point resulted in systems where fstrim was not enabled. This could cause issues such as unresponsive systems or broken file chooser dialogs. With this fix, fstrim (discards) is now enabled by default in the LUKS2 metadata on newly installed systems.

To fix this issue in the existing installations, run the following command: …. cryptsetup --allow-discards --persistent refresh <luks device> …. <luks device> is the path to the root LUKS2 device.

Jira:RHEL-82884

12.9. High availability and clusters
Copy link

Review issues that have been fixed for high availability and clusters in Red Hat Enterprise Linux 10.0.

pcs validation of SBD options
Previously, when you enabled SBD with the pcs stonith sbd enable command and specified values for SBD options that are not valid, it resulted in SBD misconfiguration. The pcs command-line interface has been updated to validate the values for SBD options. When the values are not valid, pcs reports the error and does not create or update an SBD configuration.

Jira:RHEL-38484[1]

Ability to remove Booth configuration from a Booth arbitrator node
Previously, running the pcs booth destroy command to remove Booth configuration from a Booth arbitrator node yielded an error. This happened because the command did not remove Booth configuration from nodes that are not part of the cluster. It is now possible to remove Booth configuration from Booth arbitrators.

Jira:RHEL-38486[1]

pcsd processes now consistently stop correctly and promptly
Previously, the creation method for pcsd processes sometimes caused a deadlock during process termination. The processes were then terminated only after a systemd timeout. This fix changes the process creation method and there is no longer a deadlock when the processes are stopped. As a result, pcsd consistently stops correctly within a short time.

Jira:RHEL-38478[1]

pcs no longer validates fencing topology with fencing levels greater than 9
The Pacemaker cluster resource manager ignores fencing topology levels greater than 9. Configuring levels greater than 9 might lead to failed fencing. With this update, you can configure fencing levels with values of only 1 to 9 in the pcs command-line interface and fencing topology works correctly.

Jira:RHEL-38479[1]

The syntax for specifying a score value is now consistent across all pcs constraint commands
Previously, some commands for creating constraints required you to specify a score value as score=value, whereas others expected just value without score=. With this update, all constraint commands accept a score value in the form score=value, with the exception of pcs constraint location prefers and pcs constraint location avoids, which expect node=score where score is the score value.

Jira:RHEL-34792[1]

The CIB manager no longer increases in size indefinitely with each request from an asynchronous client
Previously, when the CIB manager received a request from an asynchronous client, it leaked a small amount of memory. This caused the CIB manager process gradually to grow in size. With this fix, the relevant memory is freed for asynchronous clients and the CIB manager process does not grow in size indefinitely.

Jira:RHEL-40117

Resource constraints with expired rules no longer display
Before this update, the pcs constraint location config resources command displayed resource constraints with expired rules in the output. With this update, the command no longer displays constraints with expired rules if you do not specify the --all option.

Jira:RHEL-33386

Cluster status of a disaster recovery site now displays correctly
Before this update, when you configured a disaster recovery site and ran the pcs dr status command to display the status of the local and remote cluster sites, the command displayed an error instead of the cluster status. With this update, the cluster status of the local and remote sites displays correctly when you run this command.

Jira:RHEL-61747

Status of a cloned resource running with only one instance now displays properly
Before this update, when you queried the status of the instances of a cluster resource clone with only one running instance, the pcs status query command displayed an error message. With this update, the command reports the resource status properly.

Jira:RHEL-55723

12.10. Compilers and development tools
Copy link

Review issues that have been fixed for compilers and development tools in Red Hat Enterprise Linux 10.0.

Go applications no longer panic if OpenSSL is not installed
Previously, if the OpenSSL library was not installed, applications created with Go panicked even if the Federal Information Processing Standard (FIPS) mode was disabled. This update solves this problem. As a result, you can now run applications created with Go if OpenSSL is not installed.

Jira:RHEL-52486[1]

Go now uses ld.bfd as the default linker on the 64-bit ARM platform
In previous RHEL versions, Go used the ld.gold linker only on 64-bit ARM platforms and ld.bfd on other platforms. Because ld.gold is deprecated in the binutils project, Go now also uses ld.bfd on 64-bit ARM platforms.

Jira:RHEL-49036

Improved reliability of waking POSIX thread condition variables in glibc
Before this update, a defect in the POSIX thread condition variable implementation in glibc caused a pthread_cond_signal() API call to fail to wake a waiting thread. As a consequence, a thread could wait indefinitely for the next signal or broadcast, and applications using condition variables could appear to hang.

With this release, the implementation of POSIX thread condition variables uses a sequence-based algorithm that prevents missed wakeups in the presence of signaling and waiting races. As a result, waiting threads are now woken reliably, and multithreaded applications that use POSIX condition variables behave more predictably.

Jira:RHEL-82285[1]

12.11. Identity Management
Copy link

Review issues that have been fixed for Identity Management (IdM) in Red Hat Enterprise Linux 10.0.

The ipa idrange-add command now warns that Directory Server must be restarted on all IdM servers
Previously, the ipa idrange-add command did not warn the administrator that they must restart the Directory Server (DS) service on all IdM servers after creating a new range. As a consequence, the administrator sometimes created a new user or group with a UID or GID belonging to the new range without restarting the DS service. The addition resulted in the new user or group not having an SID assigned. With this update, a warning that DS needs to be restarted on all IdM servers is added to the command output.

Jira:RHELDOCS-18201[1]

The ipa-replica-manage command no longer resets the nsslapd-ignore-time-skew setting during forced replication
Previously, the ipa-replica-manage force-sync command reset the nsslapd-ignore-time-skew setting to off, regardless of the configured value. With this update, the nsslapd-ignore-time-skew setting is no longer overwritten during forced replication.

Jira:RHEL-4879

certmonger now correctly renews KDC certificates on hidden replicas
Previously, when the certificate was about to expire, certmonger failed to renew the KDC certificate on hidden replicas. This happened because the renewal process only considered non-hidden replicas as active KDCs. With this update, the hidden replicas are treated as active KDCs, and certmonger renews the KDC certificate successfully on these servers.

Jira:RHEL-46607[1]

Bypassing two-factor authentication by using an expired token is no longer possible
Previously, it was possible to bypass two-factor authentication by creating an OTP token with a specific end-validity period.

In cases where two-factor authentication is enforced, a user without an OTP token could use their password to log in once and configure an OTP token. Subsequently, they would be required to use both their password and the OTP token for authentication. However, if a user created an OTP token with an expired end-validity date, IdM would incorrectly fall back to password-only authentication, effectively bypassing two-factor authentication. This was due to IdM not differentiating between non-existent and expired OTP tokens.

With this update, IdM now correctly differentiates between these scenarios. Consequently, two-factor authentication is now correctly enforced, preventing this bypass.

Jira:RHEL-63325[1]

The Account Policy plugin now uses a proper flag for an update in a replication topology
Before this update, the Account Policy plugin did not use the proper flag for an update. As a result, in a replication topology, the Account Policy plugin updated the login history, but this update failed on a consumer server logging the following error message: 
{{ERR - acct_update_login_history - Modify error 10 on entry
}}

With this update, the internal update succeeds and no errors are logged.

Jira:RHEL-74164

TLS 1.3 can now be used to connect to an LDAP server running in FIPS mode
Before this update, when you tried to explicitly set TLS 1.3 when connecting to an LDAP server in FIPS mode, the used TLS version still remained 1.2. As a result, an attempt to connect to the LDAP server by using TLS 1.3 failed. With this update, the upper limit of the TLS version in FIPS mode was changed to 1.3, and the attempt to connect to an LDAP server with TLS 1.3 no longer fails.

Jira:RHEL-79498[1]

A race condition with paged result searches no longer closes the connection with a T3 error code
Before this update, Directory Server did not use the proper thread protection when checking the connection’s paged result data for a timeout event. As a consequence, the paged result timeout value changed unexpectedly and triggered a false timeout when a new operation arrived. This caused a time out error and the connection was closed with the following T3 error code:

The server closed the connection because the specified time limit for a paged result search has been exceeded.

With this update, the proper thread protection is used, and paged result searches no longer close the connection with a T3 error code.

Jira:RHEL-76020[1]

ldapsearch now respects the NETWORK_TIMEOUT setting as expected
Before this update, an ldapsearch command ignored the timeout when the server was unreachable and, as a consequence, the search hung indefinitely instead of timing out. With this update, the logic error in TLS handling was fixed by adjusting connection retries and socket options.

As a consequence, the ldapsearch command no longer ignores the NETWORK_TIMEOUT setting and returns the following error when the timeout is reached: 

  `ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)`.

Jira:RHEL-68773

OpenLDAP library no longer fails when trying to free resources
Before this update, the OpenLDAP library tried to release memory by using the SSL_CTX_free() function in its destructor when an application had already cleaned up these resources by invoking the OPENSSL_cleanup() function, either directly or via the atexit() function. As a consequence, users experienced failures or undefined behavior when the invalid SSL_CTX_free() call tried to release already-cleaned-up SSL context resources.

With this update, a safe cleanup function has been added to skip SSL context cleanup in the OpenLDAP’s destructor. As a result, the SSL context now leaks if not explicitly freed, ensuring a stable application shutdown.

Jira:RHEL-68424[1]

Reindexing no longer fails when an entry RDN has the same value as the suffix DN
Before this update, if an entry’s relative distinguished name (RDN) had the same value as the suffix distinguished name (DN) in the directory, then the entryrdn index got broken. As a result, Directory Server could perform slow search requests, get invalid results, and write alarming messages in the error log.

With this update, reindexing works as expected.

Jira:RHEL-69819[1]

12.12. SSSD
Copy link

Review issues that have been fixed for SSSD in Red Hat Enterprise Linux 10.0.

sssd-polkit-rules package content moved to sssd-common
Previously, if you needed to enable smart card support when the system security services daemon (SSSD) did not run as root, you had to install the sssd-polkit-rules package. The package provided polkit integration with SSSD. To resolve this issue, the sssd-common package now includes the content of the sssd-polkit-rules package and installation of a separate package is no longer required.

Jira:RHEL-50243

12.13. Red Hat Enterprise Linux System Roles
Copy link

Review issues that have been fixed for Red Hat Enterprise Linux system roles in Red Hat Enterprise Linux 10.0.

No property conflicts between the NetworkManager service and the NetworkManager plugin
Before this update, the network RHEL system role did not request user consent to restart the NetworkManager service when updates were available to networking packages, particularly, due to wireless interface changes. Consequently, this led to potential conflicts between the NetworkManager service and the NetworkManager plugin. Alternatively, the NetworkManager plugin was failing to run correctly. The problem has been fixed by making the network RHEL system role ask user for their consent to restart the NetworkManager service. As a result, there are no property conflicts between the NetworkManager service and the NetworkManager plugin in the described scenario.

Jira:RHEL-34887[1]

Implementation of multiple sets of key-value pairs of node attributes is now consistent with other cluster configuration components
The ha_cluster RHEL system role supports only one set of key-value pairs for each configuration item. Previously, when you configured multiple sets of node attributes, the sets were merged into a single set. With this update, the role uses only the first set you define and ignores the other sets. This behavior is now consistent with how the role implements multiple sets of key-value pairs for other configuration components that use a key-value pair structure.

Jira:RHEL-34886[1]

The postgresql RHEL system role no longer fails to set the paths to a TLS certificate and private key
The postgresql_cert_name variable of the postgresql RHEL system role defines the base path to the TLS certificate and private key without suffix on the managed node. Before this update, the role did not define internal variables for the certificate and private key. As a consequence, if you set postgresql_cert_name, the Ansible task failed with the following error message: 
The task includes an option with an undefined variable. The error was: '__pg_server_crt' is undefined. '__pg_server_crt' is undefined

With this update, the role correctly defines these internal variables, and the task sets the paths to the certificate and private key in the PostgreSQL configuration files.

Jira:RHEL-67418[1]

The bootloader RHEL system role generates the missing /etc/default/grub configuration file if necessary
Before this update, the bootloader RHEL system role expected the /etc/default/grub configuration file to be present. In some cases, for example on OSTtree systems, /etc/default/grub can be missing. As a consequence, the role failed unexpectedly. With this update, the role generates the missing file with default parameters if necessary.

Jira:RHEL-34881[1]

The podman RHEL system role can set the ownership of the host directory again
Before this update, the podman RHEL system role was using the become keyword with the user when setting the ownership of the host directory. As a consequence, the role could not properly set the ownership. With this update, the podman RHEL system role does not use become with the ordinary user. Instead, it uses the root user. As a result, podman can set the ownership of the host directory.

As a complement to this fix, the following role variables have been added to the podman RHEL system role:

  • podman_subuid_info (dictionary): Exposes information used by the role from the /etc/subuid file. This information is needed to properly set the owner information for host directories.
  • podman_subgid_info (dictionary): Exposes information used by the role from the /etc/subgid file. This information is needed to properly set the group information for host directories.

For more details about the newly added variables, see the resources in the /usr/share/doc/rhel-system-roles/podman/ directory.

Jira:RHEL-34888[1]

The linger feature can be canceled for the correct users
When processing the instruction list of configuration items from kube files or Quadlet files, the podman RHEL system role was incorrectly using the user ID associated with the entire list. It did not use the user ID associated with the list item to compile the linger file name. Consequently, the linger file was not created and therefore the podman RHEL system role could not cancel the linger feature for the actual user if necessary. With this update, podman uses the correct username to construct the linger file name. As a result, the linger feature can be canceled for the correct users.

Jira:RHEL-34889[1]

The storage RHEL system role is idempotent again
The storage RHEL system role in some cases incorrectly calculated sizes of existing devices. Consequently, running the same playbook again without changes caused the role to attempt resizing the device that already had the correct size, instead of passing without errors. With this update, the size calculation was fixed. As a result, the role now correctly identifies that the device already has the size specified by the playbook and does not try to resize it.

Jira:RHEL-34895[1]

Running the storage RHEL system role on a system with a pre-existing Stratis pool works as expected
Before this update, the storage RHEL system role could not process the existing devices and device formats. This caused the role to fail on systems with a pre-existing Stratis pool, when checking if Stratis format conformed to the configuration specified by the playbook. Consequently, the playbook failed with an error, however the Stratis pool itself was not damaged or changed. This update makes the storage RHEL system role work correctly with Stratis devices and other formats without labelling support. As a result, running a playbook on a system with a pre-existing Stratis pool no longer fails.

Jira:RHEL-34907[1]

You cannot set the name parameter for the imuxsock input type
Before this update, the logging RHEL system role incorrectly set a name parameter for the imuxsock input type. As a consequence, this input type did not support the name parameter and the rsyslog utility on the managed node printed this error …​parameter 'name' not known — typo in config file?…​. This update fixes the logging RHEL system role to ensure that the name parameter is not associated with the imuxsock input type.

Jira:RHEL-38456

GRUB2 on RHEL 10 and RHEL 9 UEFI managed nodes correctly prompts for a password
Before this update, the bootloader RHEL system role incorrectly placed the password information in the /boot/efi/EFI/redhat/user.cfg file on managed nodes that ran RHEL 10 and RHEL 9 with UEFI Secure Boot feature. The correct location was the /boot/grub2/user.cfg file. Consequently, when you rebooted the managed node to modify any boot loader entry, GRUB2 did not prompt you for a password. This update fixes the problem by setting the path for user.cfg to /boot/grub2/ in the source code. When you reboot the operating system on a UEFI Secure Boot managed node to modify any boot loader entry, GRUB2 prompts you to input your password.

Jira:RHEL-40759[1]

Removing Quadlet-defined networks by using podman works irrespective of a custom NetworkName directive
When removing networks, the podman RHEL system role was using the "systemd- + name of the Quadlet file" syntax for the network name. Consequently, if the Quadlet file had a different NetworkName directive in it, the removal would fail. With this update, the podman source code has been updated to use "the Quadlet file name + the NetworkName directive from that file" as a name of the network to remove. As a result, removal of networks defined by Quadlet files by using the podman RHEL system role works both with and without a custom NetworkName directive in the Quadlet file.

Jira:RHEL-40760

The podman RHEL system role creates new secrets if necessary
The podman RHEL system role incorrectly did not check whether a secret with the same name already existed if you used the skip_existing: true option of the podman_secrets role variable. Consequently, the role did not create any new secret if using that option. This update fixes the podman RHEL system role to check for existing secrets if you use skip_existing: true. As a result, the role properly creates new secrets if they do not exist. Conversely, it does not create a secret of the same name if you use skip_existing: true.

Jira:RHEL-40795[1]

The network units in the Quadlet unit files are now properly cleaned up
The podman RHEL system role was not correctly managing the network units defined under the [Network] section in the Quadlet unit files. Consequently, the network units were not stopped and disabled and subsequent runs would fail due to those units not being cleaned up properly. With this update, podman manages the [Network] units, including stopping and removing. As a result, the [Network] units in the Quadlet unit files are properly cleaned up.

Jira:RHEL-50104[1]

The podman RHEL system role now correctly searches for subgid values
Subordinate group IDs (subgid) is a range of group ID values assigned to non-root users. By using these values, you can run processes with different group IDs inside a container compared to the host system. Before this update, the podman RHEL system role was incorrectly searching in the subgid values by using the group name instead of using the user name. Consequently, the difference between the user name and the group name made podman fail to look up the subgid values. This update fixes podman to correctly search for subgid values and the problem no longer occurs in this scenario.

Jira:RHEL-57100[1]

The certificate RHEL system role correctly reports an error when an issued certificate is missing the private key
When the private key of a certificate was removed, the certmonger utility on a managed node entered an infinite loop. Consequently, the certificate RHEL system role on the control node became unresponsive when re-issuing a certificate that had the private key deleted. With this update, the certificate RHEL system role stops processing and provides an error message with instructions for remedy. As a result, certificate no longer becomes unresponsive in the described scenario.

Jira:RHEL-70536[1]

The firewall RHEL system role reports changed: True when there were changes applied
During playbook processing, the firewall_lib.py module from the firewall RHEL system role was replacing the changed message with False when using the interface variable in the playbook and a pre-existing networking interface on the managed node. As a consequence, firewall reported the changed: False message even when there had been changes done, and the contents from the forward_port variable were not saved as permanent. With this update, the firewall RHEL system role ensures the changed value is not reset to False. As a result, the role reports changed: True when there are changes, and forward_port contents are saved as persistent.

Jira:RHEL-67412[1]

The podman RHEL system role no longer fails to process secrets when using the run_as_user variable
Before this update, the podman RHEL system role failed to process secrets that were specified for a particular user using the run_as_user variable due to missing user information. This caused errors when attempting to process secrets which have run_as_user set. The issue has been fixed, and the podman RHEL system role correctly handles secrets which are specified for a particular user using the run_as_user variable.

Jira:RHEL-73443[1]

The cockpit RHEL system role installs all cockpit-related packages that match a wildcard pattern
Before this update, the dnf module used through the cockpit RHEL system role did not install all cockpit-related packages. As a consequence, some requested packages were not installed. With this update, the source code of the cockpit RHEL system role was changed to use the dnf module directly with an asterisk wildcard package name and a list of packages to exclude. As a result, the role correctly installs all requested packages that match the wildcard pattern.

Jira:RHEL-45944[1]

The sshd RHEL system role can configure the second sshd service correctly
Running the sshd RHEL system role to configure the second sshd service on your managed nodes caused an error if you did not specify the sshd_config_file role variable. Consequently, your playbook would fail and the sshd service would not be configured correctly. To fix the problem, deriving of the main configuration file has been improved. Also, the documentation resources in the /usr/share/doc/rhel-system-roles/sshd/ directory have been made clearer to avoid this problem. As a result, configuring the second sshd service as described in the above scenario works as expected.

Jira:RHEL-34879[1]

The network RHEL system role prioritizes permanent MAC address matching

When all of the following conditions were met:

  • A network connection specified both an interface name and a media access control (MAC) address for configuring a parent and a virtual local area network (VLAN) connection.
  • The physical interface had the same permanent and current MAC address.
  • The networking configuration was applied multiple times.

The network RHEL system role compared the user-specified MAC address against either the permanent MAC or the current MAC address from the sysfs virtual filesystem. The role then treated a match with the current MAC as valid even if the interface name was different from what the user specified. As a consequence, the "no such interface exists" error occurred. With this update, the link_info_find() method prioritizes matching links by permanent MAC address when it is valid and available. If the permanent MAC is unavailable (None or "00:00:00:00:00:00"), the method falls back to matching the current MAC address. As a result, this change improves the robustness of MAC address matching by ensuring that permanent addresses are prioritized while maintaining a reliable fallback mechanism for interfaces with no permanent address.

Jira:RHEL-73442[1]

The new sshd_allow_restart variable enables the sshd service to be restarted when needed
Before this update, the sshd RHEL system role was not restarting the sshd service on a managed node when required. As a consequence, some changes related to configuration files from the`/etc/sysconfig/` directory and environment files were not applied. To fix the problem, the sshd_allow_restart (boolean, defaults to true) variable has been introduced to restart the sshd service on the managed node when necessary. As a result, the sshd RHEL system role now correctly applies all changes and ensures the sshd service actually uses those changes.

Jira:RHEL-73439[1]

The ansible-doc command provides the documentation again for the redhat.rhel_system_roles collection
Before this update, the vpn RHEL system role did not include documentation for the internal Ansible filter vpn_ipaddr. Consequently, using the ansible-doc command to list documentation for the redhat.rhel_system_roles collection would trigger an error. With this update the vpn RHEL system role includes the correct documentation in the correct format for the vpn_ipaddr filter. As a result, ansible-doc does not trigger any error and provides the correct documentation.

Jira:RHEL-67421[1]

The storage RHEL system role correctly resizes logical volumes
The physical volume was not resized to its maximum size when using the grow_to_fill feature in the storage RHEL system role to automatically resize LVM physical volumes after resizing the underlying virtual disks. Consequently, not all of the storage free space was available when resizing existing or creating new additional logical volumes; and the storage RHEL system role failed. This update fixes the problem in the source code to ensure the role always resizes the physical volumes to their maximum size when using grow_to_fill.

Jira:RHEL-76504[1]

The storage RHEL system role now runs as expected on RHEL 10 managed nodes with VDO
Before this update, the blivet module required the kmod-kvdo package on RHEL 10 managed nodes by using Virtual Data Optimizer (VDO). However, kmod-kvdo failed to install, and as a consequence caused even the storage RHEL system role to fail. The fix to this problem ensures that kmod-kvdo is not a required package for managed nodes with RHEL 10. As a result, storage no longer fails when managed nodes with RHEL 10 use VDO.

Jira:RHEL-81963[1]

12.14. Virtualization
Copy link

Review issues that have been fixed for virtualization in Red Hat Enterprise Linux 10.0.

vGPU live migration no longer reports excessive amount of dirty pages
Previously, when performing virtual machine (VM) live migration with an attached NVIDIA vGPU, an excessive amount of dirty pages could have been incorrectly reported during the migration. This problem could have increased the required VM downtime during the migration and the migration could have potentially failed.

With this update, the underlying problem has been fixed and the correct amount of dirty pages is reported during the migration, which can reduce the required VM downtime during vGPU live migration in some cases.

Jira:RHEL-64308[1]

QEMU no longer prevents using SEV-SNP
Previously, when attempting to start a virtual machine (VM) with AMD SEV-SNP enabled, QEMU checked the incorrect capability of KVM, and the guest failed to start. As a consequence, running VMs with AMD SEV-SNP configured was not possible with RHEL10. This problem has been fixed, and running VMs with SEV-SNP works as expected now.

Jira:RHEL-58928[1]

Network boot for VMs now works correctly without an RNG device
Previously, when a virtual machine (VM) did not have an RNG device configured and its CPU model did not support the RDRAND feature, it was not possible to boot the VM from the network. With this update, the problem has been fixed, and VMs that do not support RDRAND can boot from the network even without an RNG device configured.

Note, however, that adding an RNG device is highly encouraged for VMs that use a CPU model that does not support RDRAND to increase security when booting from the network.

Jira:RHEL-66234

RHEL 10 guests no longer crash on restart in GCP and Alibaba
When using a RHEL 10.0 instance on Google Cloud Platform or the Alibaba Cloud, restarting the instance previously caused a kernel panic in the guest operating system if the virtio-net driver was in use. This issue has been fixed and RHEL 10 guests no longer crash in the described scenario.

Jira:RHEL-56981[1]

12.15. RHEL in cloud environments
Copy link

Review issues that have been fixed for RHEL in cloud environments in Red Hat Enterprise Linux 10.0.

The mana driver with Azure Accelerated Networking assigns a correct IP address to a VM
Previously, when launching a Red Hat Enterprise Linux VM on the Azure platform with Accelerated Networking enabled, the NetworkManager-wait-online.service service might failed to start on boot. Consequently, the VM might failed to acquire IP address from a DHCP server when using Azure Accelerated Networking with the mana driver. With this fix, you need to install the latest version of the WALinuxAgent-udev package. As a result, Azure VMs with Accelerated Networking along with the mana driver will be assigned with a correct IP address at boot time.

Jira:RHEL-68796[1]

12.16. Supportability
Copy link

Review issues that have been fixed for supportability in Red Hat Enterprise Linux 10.0.

The sos now obfuscates proxy passwords in several places
Previously, the sos utility did not obfuscate passwords from proxy links. For example HTTP_PROXY and HTTPS_PROXY in the /etc/environment file. As a consequence, the sos utility could collect sosreports with customer proxy passwords unless cleaned up before submitting. This may pose a security concern. Several of those places were discovered and fixed to obfuscate the passwords.

Red Hat continually improves the sos utility to enhance obfuscation capabilities; however, the complete removal of sensitive information is not guaranteed. Users are responsible for reviewing and manually cleaning up any confidential data before sharing it with Red Hat.

Jira:RHEL-67712[1]

The sos clean on an existing archive no longer fails
Previously, an existing archive could not be cleaned by running sos clean due to a regression in the sos code that incorrectly detected the root directory of a tarball and prevented it from cleaning data. As a consequence, sos clean running on an existing sosreport tarball does not clean anything within the tarball. This update adds an implementation of a proper detection of the root directory in the reordered tarball content. As a result, sos clean performs sensitive data obfuscation on an existing sosreport tarball correctly.

Jira:RHEL-35945

The sos stops collecting user’s .ssh configuration
Previously, the sos utility collected the .ssh configuration by default from a user. As a consequence, this action caused a broken system for users that are mounted by using automount utility. With this update, the sos utility no longer collects the .ssh configuration.

Jira:RHEL-22389

12.17. Containers
Copy link

Review issues that have been fixed for containers in Red Hat Enterprise Linux 10.0.

Netavark no longer fails resolving DNS TCP queries
Previously, when you ran a container in a Podman network, some domain names would not resolve even though they worked on the host system or in a container not using the Podman network. With this update, Netavark supports TCP DNS queries and the problem is fixed.

Jira:RHEL-52247

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top