STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

RHEL 9 must clear memory when it is freed to prevent use-after-free attacks.

DISA Rule

SV-257794r1069362_rule

Vulnerability Number

V-257794

Group Title

SRG-OS-000433-GPOS-00192

Rule Version

RHEL-09-212045

Severity

CAT II

CCI(s)

• CCI-001084 - Isolate security functions from nonsecurity functions.
• CCI-002824 - Implement organization-defined controls to protect its memory from unauthorized code execution.

Weight

10

Fix Recommendation

Configure RHEL 9 to enable init_on_free with the following command:
$ sudo grubby --update-kernel=ALL --args="init_on_free=1"

Regenerate the GRUB configuration:
$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

Reboot the system:
$ sudo reboot

Check Contents

Verify that GRUB2 is configured to mitigate use-after-free vulnerabilities by employing memory poisoning.

Inspect the "GRUB_CMDLINE_LINUX" entry of /etc/default/grub as follows:
$ sudo grep -i grub_cmdline_linux /etc/default/grub
GRUB_CMDLINE_LINUX="... init_on_free=1"

If "init_on_free=1" is missing or commented out, this is a finding.

Vulnerability Number

V-257794

Documentable

False

Rule Version

RHEL-09-212045

Severity Override Guidance

Verify that GRUB2 is configured to mitigate use-after-free vulnerabilities by employing memory poisoning.

Inspect the "GRUB_CMDLINE_LINUX" entry of /etc/default/grub as follows:
$ sudo grep -i grub_cmdline_linux /etc/default/grub
GRUB_CMDLINE_LINUX="... init_on_free=1"

If "init_on_free=1" is missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5551