lowkernelunverifiedrollback-safe
Ensure the overlay kernel module is not available
kmod-disable-overlay · RHEL ≥ 8 · 1 impl
Description
The overlay (overlayfs) kernel module must be disabled unless it is required (e.g. by a container runtime), reducing the kernel attack surface.
Rationale
Every loadable filesystem module is additional attack surface. If overlayfs is not needed, disabling it removes a potential exploitation vector.
Check → Remediate
Checkkernel_module_state
- name:
- overlay
- state:
- disabled
Remediatekernel_module_disable
- name:
- overlay
Framework references
CIS
rhel8 1.1.1.6rhel10 1.1.1.6
NIST 800-53
CM-7
#kernel-module#overlay#attack-surface#cis