Oracle Linux 8, 9, and 10 all run DNF 4. The Oracle Linux 10 release notes list dnf-plugins-core 4.7.0 — the DNF 4 plugin set — and Oracle’s software management guide documents the DNF 4 command set for Oracle Linux 8 and later. There is no dnf5 on an Oracle Linux box. Check with dnf --version and expect a 4.x number before you copy any Fedora instruction onto it.
What is different is the kernel, and there are two of them. Oracle Linux ships the Unbreakable Enterprise Kernel (UEK), the default, and the Red Hat Compatible Kernel (RHCK). uname -r tells you which one you are running — a UEK version ends in el9uek or el10uek — and the packages are named for it: kernel-uek and kernel. Ksplice patches are built per kernel, so the first question about any Oracle Linux box is always which kernel it is running.
What changed in Oracle Linux 10: modularity is gone. The 10.2 release notes deprecate the module kickstart command on the back of DNF modularity being deprecated, so dnf module enable is dead weight on a 10 box, same as on RHEL 10.
dnf update and dnf upgrade are the same command. Both install every available update; the difference that matters is what you filter it with, which is the next section. Oracle Linux 7 is the exception to everything in this post: it is yum, not dnf, and it is in Extended Support.

Start with the list, not the install. dnf updateinfo gives the summary — how many security, bugfix, and enhancement notices are pending. Oracle’s errata come in three types: ELSA for security advisories, ELBA for bug fixes, and ELEA for enhancements. dnf updateinfo list updates security lists the security ones with their advisory IDs and severities, and dnf updateinfo list cves lists them by CVE. Read one advisory in full with dnf updateinfo info ELSA-2026-1234.
Then pick the scope. dnf update installs everything. dnf update --security installs only packages with a security advisory. dnf update --bugfix installs only bug fixes. One advisory only: dnf update --advisory=ELSA-2026-1234, or one CVE only: dnf update --cve=CVE-2026-12345. One severity only: dnf update --sec-severity=Important — the levels are Critical, Important, Moderate, Low. dnf upgrade-minimal --advisory=ELSA-2026-1234 installs the smallest version that fixes that advisory, not the newest version in the repo. Oracle’s guide to installing security updates with DNF documents all of these.
Make it scriptable. dnf check-update --security exits 100 when security updates are available, 0 when there are none, and 1 on error.
Do not trust --security blindly. It is only as good as the advisory metadata in the repos the box is pointed at. Oracle Linux without a support subscription points at the public Oracle Linux Yum Server; with a subscription it points at ULN. Either way, if the metadata is stale or missing, --security installs nothing and exits happy. Look at the dnf updateinfo counts first.
And know what --security is for. It buys time during an incident — patch the critical CVE now, do the full update in the window. It is not a patching policy. A box that only ever gets --security drifts, and the eventual full update becomes the big one you were avoiding.

Install it, then read the config before you enable anything. dnf install dnf-automatic — the package exists on Oracle Linux 8, 9, and 10. Its behaviour lives in /etc/dnf/automatic.conf, in the [commands] section. Out of the box it downloads and reports, and installs nothing: apply_updates = no.
Pick a timer, and understand that the timer wins. The package ships four: dnf-automatic-download.timer downloads only, dnf-automatic-install.timer downloads and installs, dnf-automatic-notifyonly.timer reports only, and dnf-automatic.timer follows whatever automatic.conf says. The named timers override the config file — enabling the install timer installs updates even if the config still says apply_updates = no.
Limit it to security, on purpose. In [commands], upgrade_type = security restricts the run to packages with a security advisory; default takes everything.
The reboot setting is where the versions split. On OL 9 and 10, reboot = never is the default, when-needed reboots only when the run replaced something that needs it, and when-changed reboots after any applied update. The default reboot command is shutdown -r +5 — five minutes, no further confirmation. On OL 8 the reboot option does not exist at all; the setting is silently ignored, so an OL 8 box will install updates and never reboot, whatever the config says. (Verified against Oracle’s shipped dnf-automatic packages: 4.7.0 on OL 8 has no reboot option; 4.14.0 on OL 9 and 4.20.0 on OL 10 do.)
Production rule, stated plainly: never let dnf-automatic install on production. Notify-only or download-only on production, install on dev and staging, and let a human — or a canary ring, in Part 4 — decide when production moves.

Versionlock is the precise tool. Install the plugin — one package name on all three releases: dnf install python3-dnf-plugin-versionlock. (Oracle Linux 7 uses yum-plugin-versionlock instead.) Then dnf versionlock add kernel-uek pins the installed UEK version, dnf versionlock add kernel-uek-6.12.0-100.28.2.el10uek pins a named version, dnf versionlock list shows what is pinned, and dnf versionlock delete kernel-uek or dnf versionlock clear releases one or all of them. The locks live in one plain-text list file on all three releases: /etc/dnf/plugins/versionlock.list — set by locklist in /etc/dnf/plugins/versionlock.conf. (The /etc/yum/pluginconf.d/versionlock.list path in older articles is OL 7’s yum plugin, not DNF’s.)
Exclude is the blunt tool. In /etc/dnf/dnf.conf, under [main], exclude=kernel* blocks matching packages from every transaction, from every repo, with no record in dnf versionlock list and no expiry. It is the right tool for exactly one job: skipping one bad release while everything else moves.
When each is appropriate: versionlock when a vendor certifies a version — a UEK version a storage driver is built against, a database version an application is qualified on. Exclude when one release is broken and you need it gone today. Neither is a substitute for the discipline in Part 4: every pin gets a reason, an owner, and an expiry date. And pin the kernel you are actually running — locking kernel while the box boots UEK protects nothing.

What it is: Ksplice applies security fixes to the running kernel and to select user space libraries — glibc and openssl — without rebooting and without restarting processes. It is the one thing Oracle Linux does that RHEL does not: kpatch covers the kernel only. Ksplice covers Critical, Important, and select Moderate CVEs, for the kernel and for those two libraries. What it is not: a kernel upgrade, and not a patch for everything.
Two clients, and only one of them is current. The Enhanced Client patches kernel and user space, does known exploit detection, and works online and offline, managed with the ksplice command. The Uptrack Client patches the kernel only, managed with uptrack. Oracle’s guidance is to use the Enhanced Client on all systems — and on Oracle Linux 10 the choice is made for you: the Uptrack Client is deprecated and no uptrack package is available on OL 10 at all. Both clients share the config file /etc/uptrack/uptrack.conf.
Eligibility is a subscription question, not a technical one. Ksplice is included in Oracle Linux Premier Support, and it is available at no additional cost on Oracle Cloud Infrastructure instances — preinstalled and enabled by default on OCI images. A 30-day trial exists for everyone else. If you hold Basic, Basic Limited, or Network Support, Oracle’s answer is to talk to sales about upgrading to Premier. The access key comes from ULN: register with uln_register using your ULN username, an authentication token, and your Customer Support Identifier, subscribe to the Ksplice channels for its release and architecture — the kernel channel and, separately, the Ksplice-aware user space channel — and the key lands in /etc/uptrack/uptrack.conf. Then install the client: dnf install ksplice.
User space patching has a first step you cannot skip. The running glibc and openssl have to be Ksplice-aware versions before Ksplice can patch them in memory. Upgrade to those versions through the user space channels, then restart the system once — after that, later glibc and openssl fixes land without restarting anything. There is no way around the first reboot.
Use it the same way every time. ksplice all list-targets shows the running kernel and its effective kernel version — the version the kernel behaves as after live patches, which is what matters, not uname -r. ksplice -n all upgrade lists available updates without installing; ksplice -y all upgrade installs them, and ksplice -y kernel upgrade or ksplice -y user upgrade limits the run to one side. ksplice remove takes updates back off, by ID or all at once. Set autoinstall = yes in uptrack.conf if you want it to apply updates on its own.
The coverage window is the part people get wrong. Only specific kernel versions are actively maintained by Ksplice — Oracle publishes the maintained-kernels list in the Ksplice guide, and if your kernel is not on it, Ksplice has nothing for you until you move to one that is. And Ksplice patches memory, not disk: you must still install the regular kernel packages for released errata from ULN or the Yum Server, or the next boot runs the old, unpatched kernel.
The hard edges, from Oracle’s own limitations page. Ksplice cannot patch processes it cannot reach — a process in a different mount namespace or a changed root, which includes containers, reports an error and needs a restart to take the on-disk update instead. It cannot patch applications that use setcontext or swapcontext from glibc to switch context between threads. It does not patch PID 1 — on Oracle Linux 7 and later that is systemd, which re-executes itself on system updates. Known exploit detection is x86_64 only. And offline mode exists, through Ksplice offline RPMs, but it gives up the web interface and the Uptrack API. The Ksplice User’s Guide is the document to read before you enable any of this — particularly the maintained-kernels list and the limitations page.

Install the tool first — it is not on minimal images. dnf install dnf-plugins-core provides needs-restarting on Oracle Linux 8, 9, and 10. Then, after any update, dnf needs-restarting -r answers the only question that matters: exit code 1 means a reboot is needed, exit code 0 means it is not. Oracle’s own release notes for Oracle Linux 10.2 give exactly this command as the way to check.
Without -r it answers a different question. Plain dnf needs-restarting lists the processes still running with old libraries mapped in memory — restart those, not the box. dnf needs-restarting -s lists services to restart instead.
On a Ksplice box, know which question you are asking. Ksplice patches memory; needs-restarting looks at what is on disk. A Ksplice-patched glibc still shows up as needing a restart. Use ksplice all list-targets for the live state and needs-restarting -r for the on-disk state: the first tells you whether you are protected right now, the second tells you what the next boot will run.
The rule, without exceptions worth naming: kernel, glibc, systemd, microcode — reboot. Everything else — restart the service. And check the kernel you are actually running: uname -r against the newest installed kernel package — rpm -q kernel-uek on a UEK system, rpm -q kernel on a Red Hat Compatible Kernel system. If they differ after an update, the new kernel is on disk and the old one is in memory. Every patch run ends with dnf needs-restarting -r, and the exit code decides the next step.

ULN is where the supported fleet lives. The Unbreakable Linux Network is Oracle’s subscription service: register with uln_register and a Customer Support Identifier, and the system subscribes to channels for its release and architecture — base, UEK, Ksplice, the Ksplice-aware user space channels. Errata, CVE lists, and the Ksplice access key all come from there. Without a support subscription, the box uses the public Oracle Linux Yum Server instead: the same errata, the same ELSA IDs, no ULN-only channels.
OS Management Hub is the fleet tool now. It is an OCI service that manages Oracle Linux instances on OCI, on supported third-party clouds, and on premises: register an instance with a profile, group instances, define lifecycle environments to promote updates through dev, test, and production, and schedule jobs — including jobs that apply Ksplice updates. On-premises instances can sit behind a management station that acts as a local mirror and proxy, so only the station talks to OCI. The first-generation OS Management service reached end of life in April 2025; the Hub is what replaced it. Spacewalk, the old self-hosted answer, is upstream-ended.

Look: dnf updateinfo list updates security — then dnf update --security, or --advisory=ELSA-... for one advisory.
Automate: dnf install dnf-automatic, upgrade_type = security, enable dnf-automatic-install.timer — and know the reboot option does not exist on OL 8; it is there on OL 9 and 10.
Pin: dnf install python3-dnf-plugin-versionlock, then dnf versionlock add <package> — pin the kernel you actually boot, kernel-uek or kernel.
Live patch: Premier Support or OCI, dnf install ksplice, ksplice -y all upgrade — kernel and user space, but only maintained kernels, and the on-disk kernel still needs its errata.
Reboot: dnf needs-restarting -r — exit 1 means reboot; kernel, glibc, and systemd always mean reboot — and on a Ksplice box it answers the on-disk question, not the live one.
Fleet: ULN channels for subscribed systems, the public Yum Server for the rest; OS Management Hub groups, lifecycle environments, and scheduled jobs, including Ksplice jobs.