Oracle Linux and UEK Release History: Versions, Ksplice and Support Dates

Oracle Linux is Oracle's free, RHEL compatible distribution, and as of 25 October 2026 three releases get full Premier Support: Oracle Linux 8 until July 2029, Oracle Linux 9 until June 2032 and Oracle Linux 10 until June 2035. Oracle Linux 7 is in paid Extended Support until July 2029. Every release can boot either the Red Hat Compatible Kernel or Oracle's own Unbreakable Enterprise Kernel (UEK), now at UEK 8 on Linux 6.12.

Below: every Oracle Linux release with Oracle's published support dates, every UEK release, how the two kernels differ, what Ksplice does and does not patch, how errata are published, which security features arrived when, and a step by step patch and audit routine. Specific vulnerabilities are left to our incident posts.

Key takeaways

• Three releases have full support today. Oracle's lifetime support policy gives Oracle Linux 8 Premier Support to July 2029, Oracle Linux 9 to June 2032 and Oracle Linux 10 to June 2035, with Extended Support available to July 2032, June 2035 and June 2038.
• Oracle Linux 7 is in Extended Support, not Premier. Premier Support ended in December 2024 and Extended Support runs to July 2029. Extended Support is narrower than Premier: security errata and select high impact bug fixes for a published package list, with no hardware certification or backports.
• Oracle Linux 6 and older get no new fixes. Oracle Linux 6 Extended Support ended in December 2024, Oracle Linux 5 in November 2020. Sustaining Support is "Indefinite", but it only gives access to fixes created during the earlier support periods.
• Two kernels, one user space. Each release ships the Red Hat Compatible Kernel (RHCK) and UEK. Oracle's UEK 8 release notes say user space stays fully compatible with RHEL regardless of which kernel runs underneath.
• UEK tracks newer upstream kernels. UEK R6 is based on 5.4.17, UEK R7 on 5.15, and UEK 8 on the 6.12 long term kernel. UEK R2 to R5 are archived, and Oracle says Ksplice no longer provides patch updates for them.
• Ksplice patches memory, not disk. Oracle's Ksplice User's Guide says you must still install the regular kernel packages so the fix survives the next reboot. The Ksplice Uptrack client is deprecated on Oracle Linux 10; the Enhanced client is the one to use.
• Errata live in three places. ELSA security advisories on linux.oracle.com, OVAL definition files for scanners, and the packages themselves on the free Oracle Linux yum server or the subscriber Unbreakable Linux Network (ULN).

Where Oracle Linux came from

A 2006 debut as a RHEL compatible distribution

Oracle's own Linux blog dates the distribution's debut to Oracle OpenWorld in 2006. That post returned HTTP 403 to our scripted fetch, so we confirmed the year from a primary file we could read: the Oracle Linux yum server FAQ lists the package signing keys Oracle has used, and the first one, for "Red Hat Enterprise Linux 4, Update 6 or Compatible", was created on 5 September 2006 by the "Oracle OSS group". The errata index on linux.oracle.com still lists the two oldest product lines as "Enterprise Linux 3" and "Enterprise Linux 4", a trace of the early naming before the product settled on "Oracle Linux".

The lifetime support policy dates Oracle Linux 3 to October 2003 and Oracle Linux 4 to February 2005, before the 2006 debut. Oracle does not explain this in the policy; our reading is that support for those two codelines is dated to the upstream releases they are compatible with.

Oracle's product page says "Oracle Linux is free to download and distribute", and the yum server is "provided for free and without support". Support, ULN and Ksplice come with a paid subscription.

How Oracle Linux tracks RHEL

Oracle Linux is built to be binary compatible with Red Hat Enterprise Linux at the user space level. The UEK 8 release notes put it this way: Oracle Linux "maintains full user space compatibility" with RHEL, "independent of the kernel version that's running underneath the OS", and applications certified for RHEL need no recertification to run on UEK. Oracle's Open Source Support Policies (effective 7 August 2026) repeat the same idea for errata: all security and bug fix errata "will be Oracle Linux binaries, which are compatible with RHEL".

You can see the tracking in any Oracle security advisory. The changelog of a rebuilt package carries the upstream entry (including a "Resolves: RHEL-..." reference to the upstream tracking issue) and, when Oracle changed something, an Oracle entry on top with a ".0.1" style suffix in the release field and an Orabug reference. In the October 2026 buildah advisory ELSA-2026-88262, for example, the Oracle entry for release 1.43.1-7.0.1 says it drops a package requirement and skips one test, while the entry below it is the upstream rebuild. Oracle also ships packages of its own, such as UEK and Ksplice.

For how the upstream pipeline from Fedora to CentOS Stream to RHEL works, and how source availability changed for every RHEL compatible rebuild, see our Fedora, CentOS Stream and RHEL release history. Our Rocky Linux and AlmaLinux release history covers the other rebuilds; this post does not compare them with Oracle Linux.

Every Oracle Linux release and its support dates

All dates in this table come from Oracle's "Lifetime Support Policy: Coverage for Oracle Open Source Service Offerings", fetched on 25 October 2026. Oracle gives months, not days, so we do too. The status column is our reading of those dates against today.

The policy marks Oracle Linux 6 and 7 with an asterisk; the footnote refers to Oracle OpenStack, which was available with those releases and whose own Premier Support ended in October 2020.

What Premier, Extended and Sustaining actually include

The dates only make sense alongside Oracle's definitions, which live in a second document, the Oracle Open Source Support Policies.

Premier Support (and Premier Plus). For major releases, Oracle says Premier, Basic and Network Support "will be available for ten years" from general availability. That is why Oracle Linux 8 (July 2019) runs to July 2029 and Oracle Linux 10 (June 2025) to June 2035. Premier includes access to patches, fixes and security alerts, 24x7 access to ULN, hardware certification, access to security patches that "do not require a system reboot" (Ksplice), the OS Management Hub service, and a backport commitment: Oracle backports fixes, "using commercially reasonable efforts", for programs on its backport schedule for six months after the next release becomes generally available.

Hardware certification has a shorter clock. The policy says hardware certification is provided "for the first six years" from general availability. After that, Oracle may certify at its discretion but is under no obligation. Oracle Linux 8 passed that mark in July 2025.

Extended Support. When offered, it is "generally available for the terminal codeline release", so in practice it covers the last update of a major release (Oracle Linux 7.9 for Oracle Linux 7). It is a paid add on and is narrower than Premier: "critical security errata and select high-impact critical bug fixes", limited to the packages on Oracle's inclusion list at linux.oracle.com/es/packagelist.html. It does not include hardware certification or backports. The inclusion list page names core packages for Oracle Linux 6 such as glibc, kernel, openssh and openssl, and lists kernel-uek there as "UEK Release 4". For Oracle Linux 7 the same page says the Extended Support policy "has been updated to provide expanded coverage of security issues" plus select high impact bug fixes for a package list kept in Oracle's Extended Support datasheet, which we did not fetch. Either way, if a package you depend on is not covered, Extended Support does not promise you a fix for it.

Sustaining Support. It lasts as long as you pay for support, which is why the table says "Indefinite". It gives access to "patches, fixes, security patches and security alerts created during" the earlier Premier and Extended periods, and to rebootless patches created during Premier. The policy is explicit that it does not include "new patches, fixes, security patches and security alerts". A host in Sustaining Support is frozen at the last fix ever produced for it.

Update levels and which kernel each one boots

Within a major release, Oracle ships numbered update levels (8.0 to 8.10, 9.0 to 9.8 and 10.0 to 10.2 have release notes on docs.oracle.com as of this writing). Each update's release notes say which kernels are on the install media and which becomes the default on first boot. These are the ones we checked:

Two operational details. The Oracle Linux 9.8 notes say a system upgraded from an update with UEK R7 as default "continues to run with the kernel that's already installed", so an update level upgrade does not switch kernel lines. And each release "is tested as a bundle"; downgrading kernel packages "is not supported, unless recommended by Oracle Support".

Oracle Linux 10 also raised the hardware floor: its release notes list x86_64 support at the x86-64-v3 level, so check older CPUs before migrating.

What the Unbreakable Enterprise Kernel is

Oracle's UEK documentation describes UEK as "a Linux kernel built by Oracle and supported through Oracle Linux support", with a focus on "performance, stability, and minimal backports by tracking the mainline source code as closely as is practical". It is the kernel Oracle runs on its Engineered Systems and on Oracle Cloud Infrastructure.

The Oracle Linux 6 Administrator's Solutions Guide gives the origin story. In September 2010, Oracle announced UEK "as a recommended kernel for deployment with Oracle Linux 5". From Oracle Linux 5.5 you could choose either kernel, and in Oracle Linux 5.6 UEK became the default. The prime motivation was "a modern, high performance Linux kernel for the Exadata and Exalogic engineered systems" that could scale as CPU counts, memory and InfiniBand connections grew. That guide (a 2012 to 2021 document) also described a historical cadence: a new UEK "every 12-18 months" with quarterly updates.

Every UEK release

The upstream base and initial build come from each release's own notes on docs.oracle.com. Oracle's release notes rarely state a release day, so the year column uses the most specific date an Oracle document gives; where we could not confirm one, the table says so.

The UEK R2 note deserves a closer look because it explains a pattern you will meet again. Oracle's guide says the R2 kernel version "is stated as 2.6.39, but it is actually based on the 3.0-stable" kernel, with the version string kept at 2.6 so that utilities expecting a 2.6 kernel kept working. Version strings on kernels are labels, not proof of content: read the release field and the advisory, not the major number.

The archive note on the UEK documentation index is the line that matters most for security teams: the documentation for UEK Release 2 to Release 5 describes "software that is in Sustaining Support", Oracle "recommends that you upgrade" as soon as possible, and "if you are using Oracle Ksplice, patch updates are no longer provided for the kernels described here". A host still running UEK R5 on Oracle Linux 7 is therefore running a kernel line Oracle has archived, even though Oracle Linux 7 itself is still in Extended Support. Check the inclusion list and the kernel line together.

UEK updates and the source tree

Each UEK release gets numbered updates that move the build number while keeping the upstream base: UEK R7 Update 1 is 5.15.0-100, Update 2 is 5.15.0-200 and Update 3 is 5.15.0-300; UEK 8 Update 1 is 6.12.0-100 and Update 2 is 6.12.0-200. Oracle's UEK 8 notes say the kernel ABI "remains unchanged in all subsequent updates to the initial release", but that ABIs changed between UEK R7 and UEK 8, so anything that ships kernel modules (storage drivers, security agents, backup agents) must be re-verified with its vendor before you change lines.

UEK source is public in the oracle/linux-uek repository on GitHub, which the release notes point to. UEK 8 also added a page size option for Arm: a kernel-uek64k variant with 64k pages, available on Oracle Cloud Infrastructure Arm shapes and only as a technical preview elsewhere.

RHCK or UEK: how the two kernels differ

Both kernels are supported under Oracle Linux support, and the administrator's guide says customers "can receive full support for Oracle Linux running with either kernel". The differences are about base version, drivers, features and who publishes the fixes.

The UEK R5 notes give a concrete example of the Arm difference: "For Oracle Linux 7 on the 64-bit Arm (aarch64) platform, no RHCK is available" and UEK R5 was the only kernel.

For patching, treat the two kernels as separate components with separate advisories.

Ksplice: rebootless patching and its limits

What it is and who can use it

Ksplice is Oracle's service for applying kernel fixes, and fixes to selected user space libraries, to a running system. The Ksplice home page says it is "Available to Oracle Linux customers with Oracle Linux Premier Support", with a 30 day trial for Oracle Linux users. It supports UEK and RHCK, and Oracle says it can patch glibc and openssl in memory on Oracle Linux 6, 7, 8 and 9 for Premier Support customers.

How it works, at concept level

The Ksplice User's Guide (revision E39380-76, August 2026) describes the life cycle. When a critical bug or vulnerability is found in the kernel, Oracle produces a new kernel release and "prepares a rebootless update corresponding to that release". The update is distributed through the Ksplice Uptrack server and ULN, and the client on your host applies it to the running kernel. Conceptually, a live patch replaces specific functions in the running kernel with fixed versions, so new calls go to the fixed code without restarting anything. For user space, the Enhanced client patches the in memory pages of the Ksplice aware glibc and openssl libraries inside running processes.

The guide is precise about what this does not do. A Ksplice update "occurs in memory and takes effect immediately", which is "different than an on-disk change that requires a reboot to take effect". You "must continue to install the regular kernel packages" from ULN or the yum server so that the kernel on disk is updated too. After the next reboot, Ksplice uses the new on disk kernel as its baseline. Ksplice patches are cached in /var/cache/uptrack and reapplied "early in the boot process before the network is configured", so a host that reboots before you have installed the new kernel package still comes up patched, as long as the client is installed.

Ksplice also changes how you read the kernel version. After patching, the running kernel has an "effective version" that differs from what uname -r prints. ksplice kernel uname -r (Enhanced client) or uptrack-uname -r (Uptrack client) shows it. This matters for scanners and auditors: a scanner that reads only uname -r will report the boot version and may flag fixes that Ksplice has already applied in memory.

The two clients

Source: Table 2-1 of the Ksplice User's Guide. Oracle recommends the Enhanced client on all systems.

Known exploit detection, switched on in /etc/uptrack/uptrack.conf, adds tripwires for certain patched issues and logs when they trip.

What Ksplice does not cover

The guide's limitations section and the support policy together give a clear list:

• The on disk kernel. You still install kernel packages and still reboot eventually; Ksplice bridges the time between.
• User space beyond the Ksplice aware libraries. Only glibc and openssl are named. A fix to OpenSSH, systemd, Python or any application still needs the package update and a service restart.
• Processes in a different mount namespace or chroot. The Enhanced client cannot load updates into processes that cannot see /var/cache/ksplice, which includes many container workloads. The guide says those services "must be restarted".
• Applications that use setcontext or swapcontext for user space context switching cannot be patched.
• PID 1. Ksplice does not patch the init process; on Oracle Linux 7 and later, systemd re-executes itself on updates instead.
• Archived kernels. No Ksplice updates for UEK R2 to R5.
• Sustaining Support hosts. They get only rebootless patches created during the Premier period, so nothing new.
• Aarch64 with RHCK. Ksplice on Arm "is only available with maintained" UEK releases.

Our post on kernel live patching and what still needs a reboot covers the general limits of live patching across distributions. The Oracle specific point is that Ksplice is the only route to rebootless kernel fixes on Oracle Linux, and it is tied to Premier Support.

How Oracle publishes errata

ELSA advisories and the errata index

Oracle publishes every update as an advisory on linux.oracle.com/errata, filterable by release (from Enterprise Linux 3 to Oracle Linux 10) and by type: SECURITY, BUG and ENHANCEMENT. Security advisories carry the prefix ELSA and bug fix advisories ELBA. On 23 October 2026 the index showed, among others, an "Unbreakable Enterprise kernel bug fix update" (ELBA-2026-500511) and several ca-certificates security updates rated Critical.

Each advisory page has the same structure, which is useful when you build automation around it:

1. Type and Impact. For example "Type: SECURITY" and "Impact: IMPORTANT". Oracle's security hub links a page titled "Oracle Linux Vulnerability Impact Rating" that explains the ratings.
2. Release Date.
3. Description. The package changelog, including Oracle's own entries with Orabug numbers.
4. Related CVEs. The CVE identifiers the update addresses.
5. Updated Packages. Every RPM by release and architecture, with its SHA-256 checksum, a "Superseded By Advisory" column, and the ULN channel label (for example ol10_x86_64_appstream).

The page notes it "is generated automatically", so read the changelog, not just the summary line.

CVE pages, OVAL and the mailing list

Three more channels sit beside the advisories, all linked from linux.oracle.com/security:

• CVE pages at linux.oracle.com/cve list each CVE and the Oracle Linux advisories that address it, by release. Start here when a scanner gives you a CVE and you need to know whether Oracle has shipped a fix for your release and kernel.
• OVAL definitions at linux.oracle.com/security/oval: per year files from 2009 on, an "all" file, and per release files such as com.oracle.elsa-ol9.xml.bz2 (3.4 MB on 23 October 2026) and com.oracle.elsa-ol10.xml.bz2. OVAL is the machine readable form scanners and compliance tools use to test installed package versions against fixed versions.
• The el-errata mailing list at oss.oracle.com, for email notification of every advisory.

Yum server versus ULN

Packages reach hosts from two places. The Oracle Linux yum server at yum.oracle.com is free and public. Its Oracle Linux 9 page lists repositories for BaseOS Latest, AppStream Latest, "UEK Release 8" and "UEK Release 7", add ons, KVM utilities, RDMA packages for UEK, a "Latest RHCK with Oracle fixes" repository, and a repository "for security validations, like FIPS or common criteria". The UEK release notes give the repository IDs: ol9_UEKR8 and ol10_UEKR8 for UEK 8, ol8_UEKR7 and ol9_UEKR7 for UEK R7, alongside ol9_baseos_latest.

ULN, the Unbreakable Linux Network, is the subscriber channel. It is where Ksplice updates are distributed, it is part of every support level including Extended Support, and it is where channel labels like ol10_x86_64_appstream in the advisory pages come from. If a host in Extended Support points only at the public yum server, confirm the packages you pay for are actually reachable from it.

Mapping an advisory to a scanner finding

Most scanner findings on Oracle Linux come down to three questions:

1. Which package and which kernel? If the finding is against kernel, it is RHCK; against kernel-uek, it is UEK. They have different fixed versions and often different advisories.
2. Which release field? Oracle rebuilt packages carry Oracle specific release strings, such as the RHCK 6.12.0-55.9.1.0.1 on Oracle Linux 10.0 or the .0.1 in buildah-1.43.1-7.0.1.el10_2. A tool that compares against upstream RHEL version strings without knowing Oracle's suffixes can mark a fixed package as vulnerable or the reverse. Compare against the fixed version in Oracle's own OVAL data or advisory.
3. Is the running code the installed code? An installed kernel without a reboot, or a Ksplice patched kernel whose uname -r still shows the boot version, makes package list and running state disagree in both directions.

Which security features arrived in which release

This table lists only features we could confirm in Oracle's own release notes or notices. It is not a complete history; RHEL compatible user space features generally arrive in the matching Oracle Linux update.

The Oracle Linux 10.0 and 10.2 notes also record SELinux policy updates that confine more services.

Step by step: identify, patch, verify and record

The routine below works on Oracle Linux 8, 9 and 10 (Oracle Linux 7 uses yum instead of dnf). Nothing here deletes data, but kernel changes need a maintenance window and a rollback path.

1. Identify the release, update level and kernel line

# Release and update level
cat /etc/oracle-release
rpm -q oraclelinux-release

# Running kernel and which line it belongs to
uname -r                      # el9uek / el8uek in the string means UEK
sudo grubby --default-kernel  # what boots next time

# All installed kernels of both lines
rpm -q kernel kernel-uek kernel-uek-core

If uname -r ends in something like .el9uek.x86_64, the host runs UEK. Compare the major base (5.15.0, 6.12.0) with the UEK table above to find the line: 5.4.17 is UEK R6, 5.15.0 is UEK R7, 6.12.0 with uek is UEK 8. A 4.14.35 kernel is UEK R5, which Oracle has archived.

2. Check which repositories the host actually uses

dnf repolist
dnf repolist --all | grep -i uek

You should see one UEK repository enabled for the line you intend to run (ol9_UEKR8 or ol9_UEKR7 on Oracle Linux 9), plus the BaseOS and AppStream repositories for the same major release. Enabled repositories from another release, from an unrelated distribution or from an unknown mirror are the most common cause of mixed package sets. ULN registered hosts show ULN channels instead.

3. List pending security errata

# Security advisories that apply to this host
sudo dnf updateinfo list --security

# Full details of one advisory, including CVEs and packages
sudo dnf updateinfo info ELSA-2026-88262

# Only kernel related advisories
sudo dnf updateinfo list --security | grep -i kernel

Cross check anything important against the advisory page on linux.oracle.com/errata and, for a specific CVE, the CVE page at linux.oracle.com/cve.

4. Apply updates

# Apply all security updates
sudo dnf upgrade --security

# Or apply one advisory only
sudo dnf upgrade --advisory=ELSA-2026-88262

# Check whether a reboot or service restart is needed
sudo dnf needs-restarting -r
sudo dnf needs-restarting -s

5. If you use Ksplice, apply the rebootless patch as well

Ksplice does not replace step 4. The User's Guide asks you to keep the on disk kernel current and use Ksplice for the running one.

# Enhanced client: list available kernel updates without applying them
sudo ksplice -n kernel upgrade

# Apply kernel and user space updates
sudo ksplice -y kernel upgrade
sudo ksplice -y user upgrade

# Show what has been applied and the effective kernel version
sudo ksplice kernel show
sudo ksplice kernel uname -r
sudo ksplice all show

On older hosts with the Uptrack client, the equivalents are uptrack-upgrade -n, uptrack-upgrade -y, uptrack-show and uptrack-uname -r. The Uptrack client is deprecated on Oracle Linux 10.

6. Reboot when Ksplice is not in use, then verify

# After the maintenance window reboot
uname -r
sudo grubby --default-kernel
rpm -q --last kernel-uek-core kernel | head -5

The running kernel should be the newest installed kernel of the intended line; if not, check the grubby default entry.

7. Record the result for audit

# A small, dated evidence record per host
{
  date -u +%Y-%m-%dT%H:%M:%SZ
  hostname
  cat /etc/oracle-release
  uname -r
  sudo ksplice kernel uname -r 2>/dev/null
  rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort
} > "patch-evidence-$(hostname)-$(date +%Y%m%d).txt"

Store it with the advisory IDs you applied; Ksplice's effective version and the RPM list answer different halves of an auditor's question.

8. Check the support status once a quarter

Compare each host's release and kernel line with the tables above: Oracle Linux 6 and older get no new fixes, Oracle Linux 7 needs Extended Support, and UEK R5 or older needs a kernel line change.

Common mistakes

Assuming UEK and RHCK get the same fix on the same day. They are built from different trees and published in different advisories. A fixed RHCK says nothing about the UEK on the same host. Track both packages, and when a kernel issue is announced check Oracle's CVE page for each kernel line on each release.

Running past Premier Support without noticing. Oracle Linux 7 left Premier Support in December 2024. Without Extended Support it is effectively Sustaining Support: no new fixes. With Extended Support it still only gets fixes for the covered package list. Plan the move to 8, 9 or 10 rather than renewing indefinitely.

Keeping an archived UEK line on a supported release. UEK R5 and older are archived, with no new Ksplice patches. An Oracle Linux 7 host in Extended Support but still on UEK R5 has a supported release and an archived kernel line.

Mixing repositories. Enabling repositories from another major release, from another RHEL compatible distribution or from an unofficial mirror creates package sets that Oracle has not tested together. The release notes are explicit that a release "is tested as a bundle". Keep to Oracle's repositories plus clearly scoped third party ones, and audit dnf repolist regularly.

Forgetting reboots when Ksplice is not in use. Without Ksplice, an installed kernel update does nothing until the host reboots. The same applies to glibc and openssl updates for long running processes. dnf needs-restarting is cheap; run it after every patch cycle.

Ignoring kernel module certification when changing UEK lines. The ABI changed between UEK R7 and UEK 8. Storage, network, backup and security agents that load kernel modules need vendor confirmation for the new line before you switch.

FAQ

What is the latest version of Oracle Linux?

As of 25 October 2026, Oracle Linux 10 is the newest major release (GA June 2025), and docs.oracle.com has release notes up to Oracle Linux 10.2. Oracle Linux 9 has release notes up to 9.8 and Oracle Linux 8 up to 8.10.

When does Oracle Linux 8 reach end of life?

Oracle's lifetime support policy gives Oracle Linux 8 Premier Support until July 2029 and Extended Support until July 2032. Sustaining Support is listed as Indefinite, but it provides no new fixes.

Is Oracle Linux 7 still supported?

Only through Extended Support, which Oracle lists until July 2029. Premier Support ended in December 2024. Extended Support covers security errata and select high impact bug fixes for a specified package list, and includes ULN access.

What is the difference between UEK and RHCK?

RHCK is the kernel rebuilt from RHEL for each release. UEK is Oracle's own kernel, built to track newer upstream kernels (5.15 for UEK R7, 6.12 for UEK 8). Both run the same user space, both are supported, and they get separate advisories.

Which UEK version should I use on Oracle Linux 9?

New Oracle Linux 9 installations from 9.8 boot UEK 8 by default. Hosts upgraded from earlier 9.x updates keep UEK R7 until you switch. UEK 8 runs on the latest Oracle Linux 9 updates and on Oracle Linux 10; confirm third party kernel module support before you change.

Does Ksplice mean I never have to reboot?

No. Ksplice applies fixes in memory, but Oracle's guide says you must still install kernel packages so the fix survives a reboot. It also cannot patch processes in other mount namespaces, PID 1, or applications using setcontext, and it covers only glibc and openssl in user space.

Is Ksplice free?

Ksplice is included with Oracle Linux Premier Support. Oracle offers a 30 day trial for Oracle Linux users. Hosts in Sustaining Support only get rebootless patches that were created during the Premier period.

Where do I find Oracle Linux security advisories?

On linux.oracle.com/errata (ELSA advisories), linux.oracle.com/cve (per CVE status), linux.oracle.com/security/oval (machine readable OVAL files) and the el-errata mailing list. On a host, dnf updateinfo list --security shows the advisories that apply.

The Oracle Linux kernel and base packages can only be fixed by Oracle, through the errata and Ksplice routes above. Most of what runs on an Oracle Linux host is not in that set, though: the applications, language runtimes, container images and open source libraries you build and deploy on it carry their own dependencies, and those you can fix on your own timetable.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard does not patch Oracle Linux hosts, apply Ksplice updates or manage ULN subscriptions; the kernel and errata steps above stay with your operations team. Where it fits is the software you build on top: repositories, SBOM files and container images, including images built on an Oracle Linux base.

The first demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. On a build host running Oracle Linux, the same flow scans the application repositories and the images you build there, so you can see which components and versions each project carries alongside the OS errata routine.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: asked to fix a lodash CVE, the assistant reads the finding and advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same flow applies to a vulnerable dependency in a service you deploy on Oracle Linux, where the fix is a dependency change you make and test yourself rather than an ELSA you wait for.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, a platform team planning an Oracle Linux 7 to 9 migration can ask which projects contain a given component and version, without leaving the conversation.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

For related reading, our posts on Linux kernel long term support end dates (UEK 8 is based on the 6.12 long term kernel), Linux distribution package signing and scanning Rocky Linux containers cover adjacent ground.

Quick check

Sources

• Oracle: Lifetime Support Policy, Coverage for Oracle Open Source Service Offerings (PDF)
• Oracle Open Source Support Policies, effective 7 August 2026 (PDF)
• Oracle Linux Extended Support package inclusion list
• Oracle Linux backport schedule
• Unbreakable Enterprise Kernel documentation index
• UEK 8 release notes (6.12.0-0.20.20)
• UEK 8 Update 2 release notes (6.12.0-200)
• UEK Release 7 release notes (5.15.0-0.30)
• UEK Release 7 Update 3 release notes (5.15.0-300)
• UEK Release 6 release notes (5.4.17-2011)
• UEK Release 5 release notes (4.14.35-1818)
• UEK Release 4 release notes (4.1.12-32)
• UEK Release 3 release notes (3.8.13-16)
• Oracle Unbreakable Enterprise Kernel Release 2 release notes
• Oracle Linux 6 Administrator's Solutions Guide: About the Unbreakable Enterprise Kernel
• Oracle Linux 6 Administrator's Solutions Guide: About UEK Release 1
• Oracle Linux 6 Administrator's Solutions Guide: About UEK Release 2
• Oracle Linux 8.0 release notes
• Oracle Linux 8.10 release notes
• Oracle Linux 9.0 release notes
• Oracle Linux 9.8 release notes
• Oracle Linux 10.0 release notes
• Oracle Linux 10.2 release notes
• Oracle Linux Ksplice User's Guide (E39380-76)
• Oracle Ksplice
• Oracle Linux UEFI Secure Boot Update Notices
• Oracle Linux Security hub
• Oracle Linux errata index
• ELSA-2026-88262 advisory page
• Oracle Linux CVE index
• Oracle Linux OVAL definitions
• Oracle Linux yum server
• Oracle Linux yum server: getting started
• Oracle Linux yum server: FAQ
• Oracle Linux yum server: Oracle Linux 9 repositories
• Oracle Linux product page
• oracle/linux-uek source repository

Last reviewed: 25 October 2026. Support dates change; check Oracle's lifetime support policy and the release notes linked above before planning an upgrade.