← Rules Catalog
mediumkernelverified rollback-safe

Disable CAN kernel module

kmod-disable-can · RHEL ≥ 8 · 1 impl

Description

The CAN (Controller Area Network) kernel module must be disabled unless required for industrial control systems.

Rationale

Disabling unused kernel modules reduces the kernel attack surface and eliminates potential vulnerabilities.

Check → Remediate

Checkkernel_module_state
name:
can
state:
disabled
Remediatekernel_module_disable
name:
can

Framework references

CIS

rhel8 3.2.2rhel10 3.2.2

STIG

V-257805 / RHEL-09-213050V-230495V-281312 / RHEL-10-701100

NIST 800-53

CM-7

Live verification

rhel10:checkrhel8:checkrhel9:check
#kernel#module#can#attack-surface