Red Hat Enterprise Linux Server RHEL 8 Update Version RHEL 8.7 kernel 4.18.0-425

Red Hat Enterprise Linux 8.7 introduces new image builder, security, networking, storage, and developer tool enhancements. It also includes notable bug fixes, technology previews, and updated support guidance for RHEL 8.7.

• NSS raises the minimum RSA key size to 1023 bits, so RSA keys shorter than that can no longer be generated, signed, verified, encrypted, or decrypted.
• SCAP Security Guide updates align CIS profiles to CIS RHEL 8 Benchmark 2.0.0 and improve DISA STIG alignment for RHEL 8.
• openCryptoki now defaults to a FIPS-compliant token data format; existing tokens must be migrated before enabling FIPS mode.
• The Apache HTTP Server default LimitRequestBody value changed to 1 GiB to address CVE-2022-29404.
• GCC 12 and later support _FORTIFY_SOURCE=3, improving compile-time hardening.
• The no-aaaa resolver option in glibc can disable AAAA DNS queries for troubleshooting IPv4-only environments.
• The mmio_stale_data kernel parameter adds mitigation controls for MMIO Stale Data vulnerabilities.
• The retbleed kernel parameter adds mitigation controls for the RETBleed vulnerability.
• The spectre_v2_user and spec_store_bypass_disable defaults changed to prctl for improved container and application performance under seccomp.
• The force_cgroupv2_swappiness sysctl can deprecate per-cgroup swappiness to make swap behavior more consistent.
• The clevis-luks-askpass.path unit is enabled by default so Clevis can unlock late-mounting LUKS volumes.
• The fapolicyd update replaces Libgcrypt with OpenSSL for hash computations and adds a new subject PPID rule attribute.

• Installer now correctly installs the latest package versions and handles encrypted-device passphrase prompts in Kickstart and graphical installs.
• DNF rollback now works for transactions containing Reason Change Action items.
• ReaR fixes include better UUID mismatch reporting, PXE/RSYNC output handling, NetBackup 9 support, and removal of false symlink-target errors.
• NetworkManager fixes IPv6 address ordering, DHCP lease handling, and asymmetric routing behavior.
• grubby now preserves kernel arguments when adding newer kernels.
• Pacemaker and pcs add fixes for Booth ticket mode, watchdog timeout validation, cluster UUIDs, and resource/fence export commands.
• glibc fixes include popen() crashes, tempnam() randomness, locale -a listing, and IBM character-set conversion issues.
• Samba, SSSD, and IdM include fixes for trust handling, user preservation messages, large Kerberos databases, and LDAP group member handling.
• VDO, LVM, and storage fixes address writecache limitations, mirror/LUKS hangs, quota warnings, and device freeze issues.
• OpenSCAP/SSG fixes improve remediation behavior for tmux permissions, Rsyslog file parsing, chronyd checks, firewalld SSHD port remediation, and audit rule handling.
• Virtualization fixes include VM migration with failover VFs, virtiofs permission handling, and several VM boot and device-attachment issues.
• Container and Podman fixes include repository naming, beta image signature acceptance, and systemd-in-container support for older images.

• Image Builder on-premise now supports GCP uploads, custom /boot sizing, direct container registry pushes, and blueprint customization during image creation.
• Cronie now supports the ~ operator for randomized cron execution times.
• A new xmlstarlet package provides XML parsing, transformation, validation, and editing tools.
• chrony 4.2 adds improved interleaved mode, NTPv4 extension field support, and NTP over PTP support.
• unbound 1.16.2 adds ZONEMD verification, persistent TCP connections, SVCB/HTTPS support, and Extended DNS Errors.
• NetworkManager 1.40 adds IPv6 MTU support, DHCP lease file data, improved carrier detection, and WPA3 transition-mode handling.
• Node.js 18, Ruby 3.1, Mercurial 6.2, Maven 3.8, Redis 6.2.7, .NET 7.0, GCC Toolset 12, LLVM Toolset 14.0.6, Rust Toolset 1.62.1, and Go Toolset 1.18.2 are introduced or updated.
• RHEL System Roles gain support for SBD fencing, Corosync settings, nmstate-based networking, IPoIB, thin-provisioned storage, and expanded firewall, logging, metrics, and SQL Server options.
• The web console adds OS VM download, kpatch-only updates, richer diagnostics reports, crypto policy management, and automatic reboot after updates.
• Virtualization adds AP mask management, multi-threaded VM memory preallocation, SEV-ES support on ESXi, and Secure Execution remote attestation on IBM Z.
• Container tooling adds Podman 4.2 features, Netavark/Aardvark DNS support, sigstore signatures, and GitLab Runner support with Podman.
• IdM adds Windows Server 2022 trust support, external IdP authentication preview, smart-card roles, and LDAP bind limits after password expiration.

• IBM Z installation may assign unpredictable interface names to RoCE cards enumerated by FID.
• RHEL installation on IBM Power 10 with LPAR and Secure Boot enabled fails.
• Anaconda running as an application can alter SELinux policy on the host system.
• RHEL 8.7 cloud-init upgrades may trigger reset_rmc on RSCT-configured systems unless a lock file is created first.
• RoCE interfaces on IBM Z may lose IP settings after upgrading from RHEL 8.6 or earlier because device names change.
• Some VDO configurations can hang or panic on kernel 4.18.0-425.10.1.el8_7; disable VDO or use an earlier kernel.
• Certain grubby argument combinations do not match the documented behavior.
• LVM writecache has limitations with naming, thin pools, VDO, and resizing.
• nm-cloud-setup can remove manually configured secondary IP addresses in some cloud scenarios.
• page_poison=1 can crash the kernel on firmware with faulty EFI implementation.
• weak-modules may fail with interdependent modules built against different kernel releases.
• Some Windows VMs fail when vTPM is enabled and virtio-net uses more than 250 queues.
• The podman-machine command is unsupported and remains Technology Preview only.

• RHEL 8.7 ships with kernel 4.18.0-425.
• For IBM POWER little-endian systems with Secure Boot, firmware must be updated to FW1010.30 or later, or FW1020, to boot after the GRUB signing change.
• To use openCryptoki in FIPS mode, migrate tokens with pkcstok_migrate before enabling FIPS.
• The nodejs:18 stream can be installed with yum module install nodejs:18; upgrading from nodejs:16 requires switching streams.
• The ruby:3.1, mercurial:6.2, and maven:3.8 streams are installed via yum module install ....
• For LimitRequestBody, systems without an explicit setting now default to 1 GiB; raise it in the relevant httpd context if needed.
• The network system role now supports the nmstate API, and firewall role changes may require permanent: true for persistent state changes.
• The sshd system role can now be managed through /etc/ssh/sshd_config, and the ssh/sshd roles support RSAMinSize.
• When using cloud-init on Azure, manually configured interface settings may be overwritten on reboot.
• For RHEL 8.7 upgrades involving Samba print servers, update printer spool paths away from /var/spool/samba/ if present.
• The ansible package is deprecated in favor of ansible-core; remove ansible and install ansible-core from AppStream.
• Several Kickstart commands and options are deprecated, including auth, authconfig, multipath, bootloader --upgrade, ignoredisk --interactive, and reboot --kexec.

Product Information

Vendor: Red Hat

Product: Enterprise Linux Server

Product type: Software

Application category: Utilities

Platform: Linux

Variant: RHEL 8

Version: RHEL 8.7 kernel 4.18.0-425

Vendor release date: Nov 9, 2022

Original release notes: View on vendor site

Published on updatealert.io: Aug 11, 2026