Oracle Linux 10: What's New, Installation Guide, and Enterprise Benefits

1. Introduction

Oracle Linux 10 — generally available since 26 June 2025 — marks a defining milestone in Oracle's enterprise Linux journey. It pairs the new Unbreakable Enterprise Kernel 8.1 (UEK 8.1) with a refreshed Red Hat Compatible Kernel, while preserving 100% application binary compatibility with Red Hat Enterprise Linux 10. The result is an operating system engineered for the workloads that now dominate the enterprise: Oracle Database 23ai & Exadata, OCI-native services, Kubernetes/OKE, AI & ML pipelines, and high-throughput data platforms.

This article walks through the meaningful changes — not just the bullet-point announcement — and turns each into something a practitioner can act on. We'll cover the new kernel, the post-quantum security posture, the move from VNC to RDP for graphical installs, NVMe over Fabrics support in the installer, automation enhancements for Zero Trust, the modernized developer toolchain (including Valkey), a complete installation walkthrough with annotated installer panels and command output, and a production hardening checklist.

Audience: Linux platform engineers, DBAs, SREs, and architects evaluating Oracle Linux 10 for new builds, migrations from Oracle Linux 8/9, or as the foundation for Oracle Database, OCI, and Kubernetes workloads.

2. Why Oracle Linux 10?

Oracle Linux 10 is purpose-built to meet two trends colliding in modern infrastructure: workloads are getting heavier (AI/ML, in-memory analytics, real-time data) and the threat landscape is getting harder (quantum-era cryptography, supply-chain attacks, Zero Trust mandates). Rather than chase features, Oracle Linux 10 focuses on the substrate.

⚡Performance

UEK 8.1 brings memory-management, file-system, and networking innovations tuned for OLTP, analytics, and AI/ML — including XFS large block size and refined NUMA scheduling.

🛡Security

Post-quantum cryptography (ML-KEM) tech preview, OpenSSH rearchitecture, keystroke obfuscation, FIDO improvements, and Ksplice zero-downtime patching.

☁Cloud-Native

Optimized for OCI, OKE, and multicloud — predictable network names, consistent locale/timezone defaults, and richer container tooling out of the box.

🛠Developer Velocity

Modernized GCC, Python, Perl, Node.js, .NET — and Valkey replacing Redis as the default in-memory key-value store.

🤖Automation

Enhanced Kickstart with %certificate, encrypted DNS support, Zero Trust-ready provisioning, and consistent disk image defaults.

🏛Enterprise Support

10-year support lifecycle, OpenELA stewardship, and Premier Support with Ksplice for kernel and userspace patching without reboots.

3. Architecture & Stack Overview

The diagram below illustrates the Oracle Linux 10 platform stack — from the silicon up through the developer-facing runtimes that ship in the distribution.

4. Key New Features

UEK 8.1PQC (ML-KEM)RDP InstallerNVMe-oFValkeygrub2 2.12Ksplice

Area	What's New in Oracle Linux 10
Kernel	UEK 8.1 default; updated RHCK; long-term stable upstream base; XFS large block size; networking and storage scalability improvements.
Cryptography	Post-quantum cryptography technology preview with `ML-KEM` (NIST FIPS 203) via `pkeyutl` encapsulation/decapsulation; updated OpenSSL.
Remote Install	RDP replaces VNC for graphical remote installation. Boot options: `inst.rdp`, `inst.rdp.password`, `inst.rdp.username`.
Storage	NVMe over Fabrics devices selectable directly in the installer's Installation Destination screen.
Automation	Kickstart adds `%certificate` section with `--dir` / `--filename` options for Base64 CA cert injection — Zero Trust ready.
Networking	`net.ifnames=0` removed; predictable interface names everywhere, including image-builder disk images.
Defaults	Disk images now use consistent locale (`C.UTF-8`) and timezone (`UTC`); new users created in installer get administrative privileges by default.
Bootloader	grub2 at version 2.12 — runtime memory addition via firmware, serial console output (PCI/MMIO UARTs), VLAN support, TPM driver fixes.
Patching	Oracle Ksplice supported on OL10 (Premier Support) — kernel + glibc + OpenSSL live patching with no reboots.
Data Services	Valkey replaces Redis as the default in-memory key-value store (compatible with existing Redis clients/configs).
Developer Tools	Updated GCC, Python (faster execution, inlined comprehensions), Perl, Node.js, .NET, MySQL, Grafana.

5. UEK 8.1 — Default Kernel Deep Dive

UEK 8.1 is Oracle's optimized kernel based on the latest upstream long-term stable release, contributed to and tuned by Oracle for data-heavy and compute-intensive workloads. Three areas matter most for production:

5.1 Memory Management & File Systems

UEK 8 introduces XFS support for mounting file systems with a block size larger than the page size — a meaningful win for write-heavy transactional workloads and large sequential I/O patterns common in Oracle Database, exports, and analytics.

5.2 Networking

Refinements to the network stack reduce CPU overhead under high pps loads, with improvements to congestion control and offload paths that benefit OCI overlay networks and RDMA-class workloads.

5.3 Storage Scalability

NVMe and NVMe-oF paths are matured, with improved I/O scheduling for multi-namespace workloads — directly relevant to Exadata, ASM, and modern flash arrays.

root@ol10-host:~ — verify UEK 8.1

[root@ol10-host ~]# uname -r
6.12.0-0.el10uek.x86_64

[root@ol10-host ~]# cat /etc/os-release | head -4
NAME="Oracle Linux Server"
VERSION="10.0"
ID="ol"
PRETTY_NAME="Oracle Linux Server 10.0"

[root@ol10-host ~]# grubby --default-kernel
/boot/vmlinuz-6.12.0-0.el10uek.x86_64

[root@ol10-host ~]# dnf list installed | grep -E "kernel-uek|kernel-core"
kernel-uek.x86_64           6.12.0-0.el10uek           @ol10_UEKR8
kernel-uek-core.x86_64      6.12.0-0.el10uek           @ol10_UEKR8

Tip: Confirm UEK 8.1 boots by default before deploying production workloads. If your image was built with the RHCK as default, switch with grubby --set-default=/boot/vmlinuz-<uek-version> and reboot during the next maintenance window.

6. Security Framework & Post-Quantum Cryptography

Security in Oracle Linux 10 is more than a refresh of crypto libraries — it is a coordinated step toward the post-quantum era and tighter Zero Trust alignment.

6.1 Post-Quantum Cryptography (Technology Preview)

Oracle Linux 10 introduces ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism, NIST FIPS 203) as a tech preview. The pkeyutl utility now supports key encapsulation and decapsulation operations, giving teams a path to begin testing PQ-safe key exchange ahead of production rollout.

Important: The PQC tech preview is intended for testing and development only — not production. Use it to qualify libraries, build pipelines, and operational playbooks now, so production migration is uneventful when PQC moves to fully supported status.

6.2 OpenSSH Rearchitecture

The SSH daemon now separates connection handling from session management, reducing attack surface. Add to that keystroke obfuscation (defends against side-channel timing attacks), tighter restrictions on key forwarding/usage, automatic closure of inactive channels, and improved FIDO hardware key handling — and the platform substantially raises the bar for credential and session security.

6.3 Ksplice Zero-Downtime Patching

For Premier Support customers, Ksplice continues to deliver kernel and userspace (glibc, OpenSSL) patching without reboots. For 24×7 environments — Oracle Database, ERP, payments — this is the difference between meeting SLA and missing it.

root@ol10-host:~ — security posture

[root@ol10-host ~]# openssl list -kem-algorithms 2>/dev/null | head
  ML-KEM-512   @ default
  ML-KEM-768   @ default
  ML-KEM-1024  @ default

[root@ol10-host ~]# getenforce
Enforcing

[root@ol10-host ~]# firewall-cmd --state
running

[root@ol10-host ~]# uptrack-show --available | head -3
# Ksplice live patches available — apply with `uptrack-upgrade -y`
CVE-2025-XXXXX  Kernel UEK 8.1 fix
CVE-2025-YYYYY  glibc memory disclosure

7. RDP-Based Remote Installation

Oracle Linux 10 retires VNC for graphical remote installation and replaces it with Remote Desktop Protocol (RDP). RDP brings encrypted sessions, enforced password length, and broader native client support across Windows, macOS, and Linux. The kernel boot options change accordingly:

Old (VNC, removed)	New (RDP, OL10)
`inst.vnc`	`inst.rdp`
`inst.vncpassword=<pwd>`	`inst.rdp.password=<pwd>`
`inst.vncconnect=<host:port>`	`inst.rdp.username=<user>`

grub kernel boot line — RDP install

# Append to the Anaconda kernel command line:
inst.rdp inst.rdp.password='StrongP@ssw0rd!2026' \
         inst.rdp.username=installer \
         inst.ks=https://kickstart.techvisions.local/ol10.ks \
         ip=dhcp

# Then connect from your workstation:
$ xfreerdp /v:<target-ip>:3389 /u:installer /p:'StrongP@ssw0rd!2026'

Why this matters: RDP gives Windows-centric ops teams a native client (mstsc) without needing third-party VNC viewers, and it raises the security floor of remote provisioning to encrypted-by-default.

8. NVMe over Fabrics in the Installer

The Anaconda installer now exposes an NVMe over Fabrics tab on the Installation Destination screen. You can attach FC-NVMe or NVMe/TCP targets during install and lay the OS down directly on a fabric LUN — no post-install pivot required. This streamlines bare-metal builds for Oracle Database, Exadata-class storage, and high-throughput application tiers.

Anaconda Installer · Installation DestinationNVMe-oF

Specialized & Network Disks › NVMe Fabrics Devices

Transport

NVMe/TCP · NVMe/FC · NVMe/RDMA

Discovery Controller

10.20.30.40 : 8009

Subsystem NQN

nqn.2014-08.org.nvmexpress:uuid:ol10-boot

Selected LUN

/dev/nvme1n1 · 240 GiB · MultiPath

Partitioning

Automatic (LVM) · /boot 1 GiB · / 200 GiB · swap 16 GiB

Encryption

LUKS2 enabled · AES-XTS-512

DISCOVERY ▸ ATTACH ▸ CLAIM ▸ LAYOUT ▸ INSTALL … 72%

9. Automation, Kickstart & Zero Trust

Oracle Linux 10 sharpens the automation story for fleet provisioning:

Predictable interface names by default — net.ifnames=0 is gone, including in image-builder outputs.
Consistent locale & timezone — disk images standardize on C.UTF-8 and UTC, removing a common source of drift across environments.
Administrator-by-default user — the first user created in the installer gets administrative privileges automatically (opt out during setup if undesired).
Kickstart %certificate section — inject Base64 CA certificates into the trust store during install with --dir and --filename options, so encrypted DNS and internal TLS work from first boot. A meaningful step toward Zero Trust provisioning.

/var/www/html/ol10.ks — Kickstart excerpt

# Oracle Linux 10 — Zero Trust ready Kickstart
text
lang en_US.UTF-8
keyboard us
timezone Asia/Riyadh --utc
network --bootproto=dhcp --device=link --activate

rootpw --lock
user --name=zaheer --groups=wheel --password=$6$... --iscrypted

%packages
@^minimal-environment
chrony tuned audit policycoreutils-python-utils
%end

# Inject internal Root CA — encrypted DNS works at first boot
%certificate --dir=/etc/pki/ca-trust/source/anchors --filename=techvisions-root-ca.crt
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t
... (Base64 PEM body) ...
LS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
%end

%post --interpreter=/bin/bash
update-ca-trust extract
systemctl enable --now firewalld auditd chronyd
setenforce 1
%end

reboot

10. Developer Ecosystem & Valkey

Oracle Linux 10 delivers a meaningfully refreshed developer toolchain:

GCC — new C/C++/OpenMP features, hardened security flags, improved diagnostics, performance-oriented optimizations.
Python — faster execution from optimized compiler settings; inlined comprehensions for measurable performance gains; updated typing syntax.
Perl, Node.js, MySQL — modernized for performance and operational security.
.NET — new networking and data-access APIs; broader platform/architecture support.
Grafana — refreshed UI and stronger user access controls.
Valkey — Redis-compatible, in-memory key-value store, replaces Redis as the default. Open-source community governance, full client/config compatibility, scalable performance.

root@ol10-host:~ — Valkey quickstart

[root@ol10-host ~]# dnf install -y valkey
[root@ol10-host ~]# systemctl enable --now valkey
[root@ol10-host ~]# valkey-cli ping
PONG

[root@ol10-host ~]# valkey-cli INFO server | head -7
# Server
redis_version:7.x.x
redis_mode:standalone
os:Linux 6.12.0-0.el10uek x86_64
multiplexing_api:epoll
process_id:1879
uptime_in_seconds:42

# Existing Redis clients point at port 6379 unchanged — drop-in replacement.

11. Installation Guide — Step by Step

The walkthrough below uses annotated installer panels and command output so you can validate each phase even on a headless server. Allow ~25–40 minutes for a typical bare-metal install on modern hardware.

Step 1 — Download Oracle Linux 10

Pull the official ISO from the Oracle Linux yum server or Oracle Software Delivery Cloud. Verify the checksum before flashing media.

$ download & verify ISO

zaheer@workstation:~$ curl -O https://yum.oracle.com/ISOS/OracleLinux/OL10/u0/x86_64/OracleLinux-R10-U0-x86_64-dvd.iso
zaheer@workstation:~$ curl -O https://yum.oracle.com/ISOS/OracleLinux/OL10/u0/x86_64/OracleLinux-R10-U0-x86_64-dvd.iso.sha256
zaheer@workstation:~$ sha256sum -c OracleLinux-R10-U0-x86_64-dvd.iso.sha256
OracleLinux-R10-U0-x86_64-dvd.iso: OK

Step 2 — Create Bootable Media

On Linux, dd is the most reliable method. On Windows use Rufus; on macOS, balenaEtcher.

$ flash USB on Linux

zaheer@workstation:~$ lsblk -d -o NAME,SIZE,TRAN | grep usb
sdb   32G   usb

zaheer@workstation:~$ sudo dd if=OracleLinux-R10-U0-x86_64-dvd.iso of=/dev/sdb bs=4M status=progress oflag=sync
5462982656 bytes (5.5 GB, 5.1 GiB) copied, 132 s, 41.4 MB/s
sync; done.

Step 3 — Boot & Select Installation Mode

Boot from the USB or virtual ISO, then select Install Oracle Linux 10. For headless installs, append the RDP boot options shown in Section 7.

GRUB · Oracle Linux 10 Installer MenuUEFI / BIOS

Welcome to Oracle Linux 10

▸ Install Oracle Linux 10

Selected

Test this media & install

Available

Troubleshooting →

Available

Kernel

vmlinuz · UEK 8.1 (6.12.0-0.el10uek)

Bootloader

grub2 v2.12 · TPM 2.0 detected

Step 4 — Configure Installation Settings

The Anaconda summary hub presents every choice on a single screen. Configure each tile in turn:

Anaconda · Installation SummaryOL 10.0

Configure all required items before "Begin Installation"

Language

English (United States)

Keyboard

English (US)

Time & Date

Asia/Riyadh · NTP: pool.ntp.org

Software Selection

Server with GUI · + Headless Mgmt, Container Tools

Installation Destination

NVMe-oF · /dev/nvme1n1 · LVM · LUKS2

Network & Hostname

eno1 (DHCP) · hostname: ol10-host.techvisions.local

Root Password

Locked (sudo via wheel)

User Creation

zaheer · Administrator (default)

Security Profile

CIS Benchmark — Level 1 (Server)

Step 5 — Begin Installation

Click Begin Installation. The installer pulls packages, lays down the bootloader, applies the security profile, and writes the user/host configuration.

Anaconda · Installation ProgressInstalling

Installing Oracle Linux 10 (UEK 8.1)

Phase

Installing packages (1,842 of 2,560)

Current Package

kernel-uek-core-6.12.0-0.el10uek

Bootloader

grub2-efi-x64 · scheduled

Security Profile

CIS · pending post-install remediation

DOWNLOAD ▸ INSTALL ▸ CONFIGURE ▸ BOOTLOADER ▸ FIRSTBOOT … 68%

Step 6 — Reboot & Validate

Remove the install media and reboot. Once the system is up, validate kernel, OS release, network, and security posture:

root@ol10-host:~ — first boot validation

[root@ol10-host ~]# cat /etc/os-release
NAME="Oracle Linux Server"
VERSION="10.0"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="10.0"
PLATFORM_ID="platform:el10"
PRETTY_NAME="Oracle Linux Server 10.0"

[root@ol10-host ~]# uname -r
6.12.0-0.el10uek.x86_64

[root@ol10-host ~]# hostnamectl
   Static hostname: ol10-host.techvisions.local
         Icon name: computer-server
           Chassis: server
        Machine ID: 9f1b2c3d4e5f60718293a4b5c6d7e8f9
           Boot ID: 0a1b2c3d4e5f60718293a4b5c6d7e8f9
  Operating System: Oracle Linux Server 10.0
       CPE OS Name: cpe:/o:oracle:linux:10:0:server
            Kernel: Linux 6.12.0-0.el10uek.x86_64
      Architecture: x86-64

12. Post-Install Validation Checklist

root@ol10-host:~ — health checks

# 1. Kernel + OS
# uname -r && cat /etc/oracle-release
6.12.0-0.el10uek.x86_64
Oracle Linux Server release 10.0

# 2. Subscription / repos
# dnf repolist enabled | head
ol10_baseos_latest    Oracle Linux 10 BaseOS Latest (x86_64)
ol10_appstream        Oracle Linux 10 Application Stream (x86_64)
ol10_UEKR8            Oracle Linux 10 UEK Release 8 (x86_64)
ol10_addons           Oracle Linux 10 Addons (x86_64)

# 3. Security posture
# getenforce; firewall-cmd --state; systemctl is-active auditd
Enforcing
running
active

# 4. Time sync (KSA timezone)
# chronyc tracking | head -3
Reference ID    : C0A80101 (ntp.techvisions.local)
Stratum         : 3
Ref time (UTC)  : Sat Jun 06 23:14:02 2026

# 5. Storage (NVMe-oF if used)
# nvme list
/dev/nvme1n1  ol10-boot   240.06 GB / 240.06 GB   NVMe-oF/TCP

13. Production Hardening Best Practices

13.1 Kernel & Patching

Standardize on UEK 8.1 unless a vendor explicitly requires RHCK.
Enable Ksplice (Premier Support) and schedule policy-driven live patching.
Apply dnf update -y through a controlled change window for non-Ksplice updates.

13.2 Identity & Access

Lock the root account; enforce sudo via wheel with logging.
Disable password authentication for SSH; require keys (FIDO2 where available).
Adopt the OpenSSH keystroke obfuscation defaults; enforce ClientAliveInterval.

13.3 Network & Perimeter

Adopt named firewalld zones per workload tier; default to deny-by-default ingress.
Treat the host firewall as a defense-in-depth layer — not as your primary "firewall." (As an architectural metaphor, "firewall" is increasingly outdated; identity-aware proxies and Zero Trust segmentation matter more.) Use the term where it aids clarity.
Enable encrypted DNS and pin internal CAs at install time via the Kickstart %certificate section.

13.4 Compliance Profiles

Apply CIS Benchmark Level 1 (Server) or DISA STIG via the OpenSCAP profile installed during setup.
Schedule weekly oscap scans and feed results into your SIEM.
For KSA workloads, align with NCA ECC-2:2024 and CCC-2:2024 controls.

13.5 Automation

Treat Kickstart as code — version it, peer-review it, sign the artifacts.
Use Ansible / Terraform / OCI Resource Manager for cross-environment consistency.
Bake images with consistent C.UTF-8 + UTC defaults; override per region only as needed.

13.6 Observability

Stand up Prometheus + Grafana (refreshed in OL10) or Oracle Enterprise Manager.
Forward audit logs to a central SIEM; retain per regulatory mandate.
Use OCI Monitoring for cloud-native fleet metrics.

14. Cloud, AI & OCI Workloads

Oracle Linux 10 is a particularly strong fit for the following workload classes — each benefiting from UEK 8.1's storage and networking improvements plus the security/automation foundation:

Workload	Why OL10 Fits
Oracle Database 23ai & Exadata	UEK 8.1 I/O scaling, XFS large blocks, NVMe-oF, Ksplice live patching.
OCI Compute & OKE	Predictable interface names, consistent locale/UTC, container tooling, identity-aware ingress.
AI / ML Pipelines	Modern GCC, Python (faster + inlined comprehensions), GPU drivers via UEK; integrates with OCI Data Science.
HPC	Refined NUMA, RDMA, and storage paths; aarch64 support for Ampere-class clusters.
Enterprise Middleware (EBS, WebLogic)	Stable RHEL ABI compatibility; Premier Support with Ksplice; strong upgrade path from OL8/OL9.

15. Upgrading from OL8 / OL9 with Leapp

Customers on Oracle Linux 8 can hop to OL9 with Leapp; OL9 systems can then upgrade to OL10. Plan a two-step path with a non-production rehearsal in between, and always pre-validate with the Leapp pre-upgrade report.

root@ol9-host:~ — Leapp OL9 → OL10

[root@ol9-host ~]# dnf install -y leapp-upgrade
[root@ol9-host ~]# leapp preupgrade --target 10.0
# review /var/log/leapp/leapp-report.txt — resolve all "inhibitors" before continuing

[root@ol9-host ~]# leapp upgrade --target 10.0
Upgrade transaction prepared. Reboot to start the upgrade phase.

[root@ol9-host ~]# reboot
# Post-upgrade: validate kernel = UEK 8.1, repos point to ol10_*, and rerun your CIS scan.

Practitioner advice: Treat the Leapp pre-upgrade report as a gate, not a suggestion. Inhibitors involving deprecated cryptographic algorithms, removed Python 2 dependencies, or out-of-tree kernel modules are the most common blockers — fix them in OL9 first, then upgrade.

16. Conclusion

Oracle Linux 10 is the most consequential release in years — not because of any single headline feature, but because every layer has moved forward together. UEK 8.1 modernizes the kernel for data-heavy and AI workloads. The security posture is materially stronger with PQC ML-KEM (tech preview), the OpenSSH rearchitecture, and Ksplice. The installer is finally encrypted-by-default with RDP, NVMe-oF aware, and Zero Trust friendly via Kickstart certificate injection. The developer toolchain is up-to-date, and Valkey replaces Redis without disruption. All of this is wrapped in 100% RHEL 10 ABI compatibility and a 10-year support lifecycle.

For organizations on Oracle Linux 8 or 9, OL10 should be on the modernization roadmap this year. For greenfield builds — Oracle Database, OKE, AI/ML, OCI workloads — it is the rational default.

In a follow-up post, I'll walk through hands-on screenshots of the installer flow, a CIS-aligned post-install hardening script, and a real-world OL9 → OL10 Leapp migration with a workload mapping playbook for KSA-regulated environments.

Author

Syed Zaheer

Service Delivery Director - Techvisions - Riyadh KSA