mediumsystemverified ✓rollback-safe
Disable kexec_load
kexec-load-disabled · RHEL ≥ 8 · 1 impl
Description
The kernel.kexec_load_disabled sysctl must be set to prevent loading a new kernel for execution.
Rationale
kexec can be used to load and execute a new kernel, bypassing security controls and potentially loading a malicious kernel. Disabling this feature prevents such attacks.
Check → Remediate
Checksysctl_value
- key:
- kernel.kexec_load_disabled
- expected:
- 1
Remediatesysctl_set
- key:
- kernel.kexec_load_disabled
- value:
- 1
Framework references
STIG
V-230266V-257799V-281307 / RHEL-10-701050
NIST 800-53
CM-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#sysctl#kexec#kernel#security#stig