Red Hat Enterprise Linux 10.3 can now block a system from loading files that changed after deployment. Red Hat released RHEL 10.3 and RHEL 9.9 on November 11, 2026, according to the official Red Hat release blog. The two updates do not carry the same features, so the version you run decides what you get.
The headline items are sealed images, a supported MCP server for AI agents, a new command-line assistant preview and fresh developer toolchains. Some of these land in both branches. Others are listed only for RHEL 10.3.
What changes for you
The split matters most for teams that plan their upgrades a year ahead. Red Hat first announced the releases on November 9 at KubeCon + CloudNativeCon North America in Salt Lake City. Its press release on the new RHEL versions said general availability would come “in the coming weeks.” Two days later, the company’s blog post described both versions as released.
RHEL 10.3 compared with RHEL 9.9
The table below uses only what Red Hat and the cited reports state. A dash means the sources do not say.
| Feature | RHEL 10.3 | RHEL 9.9 |
|---|---|---|
| Sealed images for image mode | Yes, generally available | Not listed |
| Post-quantum protection for Go applications | Yes | Not listed |
| MCP server for RHEL | Yes, generally available | Yes, generally available |
| Command-line assistant with self-managed AI | Developer Preview | Developer Preview |
| GCC 16, Go 1.27, .NET 11, Node.js 26 LTS | Yes | Yes |
| Supported in-place upgrade | From RHEL 9.9 | From RHEL 8.10 |
| Base kernel | Linux 6.12 with Red Hat patches | – |
Paid customers and free users
Subscribers download the finished install images from the Red Hat Customer Portal. Red Hat also offers a 60-day RHEL 10.3 trial for internal evaluation.
Developers have a no-cost path. The Red Hat Developer program includes a one-year subscription to many Red Hat products. A separate RHEL for Business Developers option gives up to 25 entitlements per registered user, but only for development and testing. Production use still needs a paid subscription.
Anyone who wants to look at the upstream code base can grab public CentOS Stream 10 ISO images. The latest builds in that folder are dated November 12, 2026.
Sealed images explained
Image mode lets admins deploy RHEL as a container-style image, built on bootc. Sealed images add a signature check that runs from the firmware and bootloader through the kernel and the root filesystem. Customers sign the image with their own secure boot keys.
The root filesystem stays read-only. Red Hat’s blog says “tampered content is refused by the kernel at read time rather than served.” SiliconANGLE’s report on the RHEL updates notes the keys stay under customer control.
Red Hat pitches the feature at financial, healthcare and government groups that must prove their systems are unchanged. It calls sealed images a foundation for zero trust security.
AI tools: what is supported and what is still a preview
The MCP server for RHEL has moved from Developer Preview to general availability. MCP, or Model Context Protocol, gives AI assistants a standard way to read system data. Here, it helps those assistants diagnose problems on live machines.
It ships as an RPM in the RHEL extensions repository, so a normal dnf command installs it. Red Hat says agent access is governed by default. The server works with compatible agents such as the open source goose agent.
The MCP server can also read Performance Co-Pilot (PCP) archives. That lets an agent compare live data with past data to find the cause of intermittent slowdowns. Linuxiac’s breakdown of RHEL 10.3 adds that it queries this history over SSH.
The command-line assistant answers plain-language questions in the terminal, using Red Hat knowledge. Customers can now run it with their own hosted inference. That keeps data inside air-gapped or disconnected networks. Linuxiac reports that this self-managed mode uses customer-hosted models through OpenShift AI. It remains a Developer Preview, while Red Hat’s hosted version stays available for connected systems.
New grafana-pcp AI dashboards combine GPU, CPU and network data. According to Linuxiac, one view tracks vLLM inference servers, covering request latency, token throughput, queue activity and cache use.
Technical details for developers and admins
Toolchains and runtimes
Red Hat lists GCC 16, LLVM 22, Go 1.27 and Rust 1.97 as the new toolsets. Runtimes include .NET 11, Node.js 26 LTS and PHP 8.4.
Linuxiac gives more detail on RHEL 10.3. GCC Toolset 16 ships GCC 16.2.1 and GNU Binutils 2.46. It switches the default C++ standard from C++17 to C++20 and adds some C++26 features. It also brings tuning for AMD Zen 6 and newer Intel chips. The toolset installs from AppStream next to the default system compiler.
GDB 17.2 improves debugging on RISC-V and adds Debugger Adapter Protocol support. Valkey 8.1 improves memory use, encrypted connections, replication and cluster failover. An optional valkey-rdma module adds RDMA support.
Kernel and security changes
RHEL 10.3 stays on Linux kernel 6.12 with Red Hat patches and backports, Linuxiac reports. Integrity Measurement Architecture (IMA) checks now cover file systems that were excluded before. Modified programs on those file systems can no longer slip past the check.
Kernel Samepage Merging can now merge only zero-filled memory pages. This cuts scanning overhead on virtual machine hosts. The Real-Time Linux Analysis tool can also run custom eBPF programs.
On cryptography, the press release says RHEL 10.3 builds post-quantum protection into the Go toolchain. SiliconANGLE adds that this includes the ML-KEM algorithm in Go’s TLS code. The goal is to defend against “harvest now, decrypt later” attacks. Red Hat says its post-quantum support helps regulated customers meet CNSA 2.0 requirements.
How to prepare for the upgrade
- Check your current version with
cat /etc/redhat-release. - On RHEL 9, move to 9.9 first. Red Hat supports a Leapp in-place upgrade from RHEL 9.9 to 10.3.
- On RHEL 8, upgrade to 8.10 before you go further. Leapp supports the jump from RHEL 8.10 to 9.9.
- Read the RHEL 10.3 release notes for known issues on the 9.9 to 10.3 path.
- Test new compiler defaults, such as C++20 in GCC Toolset 16, before you rebuild production code.
Support timing is another factor. Red Hat’s RHEL life cycle policy gives each major release five years of full support and five years of maintenance support. Extended phases cost extra. The lifecycle table on Wikipedia’s RHEL entry puts maintenance end dates at May 2029 for RHEL 8, May 2032 for RHEL 9 and May 2035 for RHEL 10.
What remains unclear
Red Hat has not said when the command-line assistant’s self-managed mode will leave Developer Preview. It also has not explained whether sealed images will reach the RHEL 9 branch. The sources do not list a kernel version for RHEL 9.9.
Red Hat says agent access to the MCP server is governed by default. The announcements do not spell out which actions an agent may take. Teams that plan to connect AI agents to production servers should watch the documentation on that point.
