Table of Contents

• Title and Copyright Information
• Preface
• 1 About Oracle Linux 9
  • System Requirements and Limitations
  • Available Architectures
  • Shipped Kernels
  • About the Unbreakable Enterprise Kernel
  • User Space Compatibility
  • Obtaining Installation Images
  • Upgrading From Previous Oracle Linux Releases
  • Upgrading From Previous Oracle Linux Update Releases
• 2 New Features and Changes
  • Installation and Boot
    • UEK R8 Default Kernel Handling
  • Infrastructure Services
    • chrony rebased to version 4.8
    • valgrind rebased to upstream version 3.26.0
    • SystemTap is rebased to version 5.4
    • elfutils rebased to 0.194
    • sscg rebased to version 4.0.3
  • Security
    • AIDE rebased to 0.19.2
    • p11-kit-client.so separates to the p11-kit-client subpackage
    • OpenSSH provided in version 9.9
    • Valkey runs with the redis_t SELinux type
    • fapolicyd rebased to 1.4.5
    • CanonicalMatchUser in sshd_config prevents privilege escalation for capitalized AD usernames
    • GnuTLS rebased to 3.8.10
    • crypto-policies supports hybrid ML-KEM and pure ML-DSA in GnuTLS
    • /dev/papr-* devices have more specific SELinux labels
    • p11-kit rebased to 0.26.1
    • New package: clevis-pin-trustee
    • crypto-policies enables mlkem768x25519-sha256 for OpenSSH
    • OpenSCAP rebased to 1.3.13
    • SCAP Security Guide rebased to 0.1.80
  • Networking
    • iproute rebased to version 6.17.0
    • FRRouting 10 package introduced in Oracle Linux 9 AppStream repository
    • Unbound rebased to version 1.24.2
  • Kernel and System Libraries
    • crash rebased to 9.0.2
  • File Systems and Storage
    • cryptsetup rebased to version 2.8.0
    • snapm rebased to 0.7.0
  • High Availability and Clusters
    • HAProxy rebased to 2.8
  • Dynamic Programming Languages, Web and Database Servers
    • A new module stream: postgresql:18
    • A new module stream: mariadb:11.8
    • New ruby:4.0 runtime module stream with database connectors
    • The mysql:8.4 module now includes the perl-DBD-MySQL package
    • New Python 3.14 stack is available
  • Compilers and Development Tools
    • Rust Toolset is rebased to version 1.92.0
    • Rebase llvm toolset to version 21
  • Containers
    • container-selinux rebased to version 2.245.0-1
  • Cockpit Web Console
    • cockpit rebased to version 356
  • Identity and Authentication
    • samba rebased to 4.23.0
    • ipa rebased to 4.13.0
    • cepces rebased to 0.3.12
    • pki rebased to 11.7.1
    • ansible-freeipa rebased to 1.16.0
    • 389-ds-base rebased to 2.8.0
    • sudo rebased to sudo-1.9.17p2
  • Operating System and Software Management
    • librepo rebased to 1.19.0
  • Shells and Command Line Tools
    • Security and TLS improvements in openwsman 2.8.1
    • openCryptoki rebased to 3.26.0
    • Oracle build of OpenJDK 25 available in Oracle Linux 9
• 3 Technology Preview
  • Security
    • KTLS
    • QUIC Protocol in OpenSSL
    • io_uring Asynchronous I/O Interface
  • Infrastructure Services
    • Socket API for TuneD
  • Networking
    • gpsd-minimal
    • WireGuard
    • systemd-resolved Service
    • PRP and HSR
    • IPsec Packet Offloading
    • Various Modem Network Drivers
    • Segment Routing Over IPv6
  • Kernel
    • Soft iWarp
  • File Systems and Storage
    • nvme-stas Package
  • Compilers and Development Tools
    • jmc-core and owasp-java-encoder
    • Flexible Array Conversion Warning-Suppression in libabigail Available As a Technology Preview
  • Virtualization
    • Nested VMs
    • SEV and SEV-ES
• 4 Deprecated Features
  • Installation
    • Kickstart Commands
    • initial-setup Package
    • inst.geoloc Boot Option Values provider_hostip And provider_fedora_geoip
    • Anaconda Screenshots
    • Anaconda Help
  • Software Management
    • DNF debug plugin
    • DNF libreport
  • Shell and Command Line
    • dump Utility
    • Bacula Sqlite Backend Database
    • TMPDIR Variable in the ReaR Configuration File
  • Security
    • Unprivileged Access to dmesg Output
    • OVAL Data Format
    • Using update-ca-trust Without Arguments
    • Configuring STunnel Clients to Use the Trusted Root CA Files
    • NSS Deprecated Algorithms
    • pam_ssh_agent_auth
    • scap-workbench
    • oscap-anaconda-addon
    • /etc/system-fips
    • libcrypt.so.1
    • SHA-1 Algorithm
    • SCP Protocol
    • OpenSSL Cryptographic Algorithms
    • Digest-MD5
    • /etc/system-fips File
    • libcrypt.so.1
    • fapolicyd.rules File
    • OpenSSL RSA Encryption Without Padding
    • OpenSSL Engines API
    • openssl-pkcs11
  • Networking
    • Soft-iWarp
    • Network Teams
    • dhcp-client Package
    • firewalld Lockdown
    • /etc/sysconfig/network-scripts File
    • iptables Framework
    • PF_KEYv2 Kernel API
    • Network Manager nmcli Language Changes
    • TigerVNC
  • Kernel
    • crashkernel=auto Option
    • Asynchronous Transfer Mode
    • kexec_load in kexec_tools
    • cgroupsv1
  • File Systems and Storage
    • lsscsi NVMe
    • sg3_utils NVMe
    • lvm2-activation-generator
    • PMDK Library
    • md-linear and md-faulty MD RAID Kernel Modules
    • Virtual Data Optimizer Parameters in sysfs
  • High Availability
    • Several Pacemaker Configuration Options
  • Dynamic Programming Languages, Web and Database Servers
    • Berkeley DB (libdb)
  • Compilers and Development
    • Redis in Grafana, PCP, and grafana-pcp
    • llvm-doc HTML Content
    • Keys Smaller Than 2048-bits in OpenSSL
    • Some PKCS1 v1.5 modes
    • 32-bit multilib Linking
  • Identity Management and Authentication
    • PAM Console
    • BDB backend (in 389-ds-base)
    • sss_ssh_knownhostsproxy
    • libsss_simpleifp
    • SSSD Files Provider
    • OpenLDAP Utility Options
    • nsslapd-idlistscanlimit Parameter and Default Value
    • SMB1 Protocol
  • Virtualization
    • Signatures Using SHA-1
    • Virtual Machine Manager
    • Virtual Machine Snapshots
    • libvirtd Daemon
    • Virtual Floppy Driver
    • qcow2-v2 Format
    • Legacy CPU Models
    • RDMA-based Live Migration
    • Windows 8 and Windows Server 2012 Guest Operating System
    • NIC Device Drivers for iPXE
    • Intel vGPU
    • pmem Device Passthrough
  • Containers
    • containers.conf for System Connections
    • slirp4net
    • cgroupsv1 in Rootless Containers
    • runc Container Runtime
    • pasta as a Network Name
    • BoltDB Database Backend
    • Oracle Linux 9 Containers on Oracle Linux 7 Hosts
    • SHA-1 Algorithm Within Podman
    • CNI Network Stack
  • Deprecated Packages
• 5 Known Issues
  • Installation Issues
    • (aarch64) Minimum XFS File System Size During Install Is 300 MB
  • Virtualization Issues
    • KVM Virtual Machines Panic When Started on Oracle Linux 9 Hosts
    • Virtual Machines Fail to Start at Boot Because the virbr0 Interface Isn't Available
  • Kernel Issues
    • Kdump Might Fail on Some AMD Hardware
  • (aarch64) Some GUI Elements Aren't Displayed During Installation and Boot Using VGA Output
  • Certain SEV Guest Configurations Might Cause Hypervisor CPU Soft-Lockup Warnings
  • Systems With Btrfs Fail to Boot in FIPS Mode
  • Leapp Upgrade Messages About Unmounted /proc File System
• 6 Package Changes From the Upstream Release
  • Changes to Binary Packages
    • Added Binary Packages for BaseOS by Oracle
    • Added Binary Packages for AppStream by Oracle
    • Added Binary Packages for CodeReady Linux Builder by Oracle
    • Modified BaseOS Binary Packages
    • Modified Binary Packages for CodeReady Linux Builder by Oracle
    • Modified AppStream Binary Packages
    • Removed BaseOS Binary Packages
    • Removed AppStream Binary Packages
    • Removed CodeReady Linux Builder Binary Packages
  • Changes to Source Packages
    • Added Source Packages for BaseOS by Oracle
    • Added Source Packages for AppStream by Oracle
    • Modified BaseOS Source Packages
    • Modified AppStream Source Packages
    • Modified Source Packages for CodeReady Linux Builder by Oracle
    • Removed BaseOS Source Packages
    • Removed AppStream Source Packages