STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

The kdump service on RHEL 9 must be disabled.

DISA Rule

SV-257818r1044876_rule

Vulnerability Number

V-257818

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

RHEL-09-213115

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Disable and mask the kdump service on RHEL 9.

To disable the kdump service run the following command:

$ sudo systemctl disable --now kdump

To mask the kdump service run the following command:

$ sudo systemctl mask --now kdump

Check Contents

Verify that the kdump service is disabled in system boot configuration with the following command:

$ sudo systemctl is-enabled kdump

disabled

Verify that the kdump service is not active (i.e., not running) through current runtime configuration with the following command:

$ sudo systemctl is-active kdump

masked

Verify that the kdump service is masked with the following command:

$ sudo systemctl show kdump | grep "LoadState\|UnitFileState"

LoadState=masked
UnitFileState=masked

If the "kdump" service is loaded or active, and is not masked, this is a finding.

Vulnerability Number

V-257818

Documentable

False

Rule Version

RHEL-09-213115

Severity Override Guidance

Verify that the kdump service is disabled in system boot configuration with the following command:

$ sudo systemctl is-enabled kdump

disabled

Verify that the kdump service is not active (i.e., not running) through current runtime configuration with the following command:

$ sudo systemctl is-active kdump

masked

Verify that the kdump service is masked with the following command:

$ sudo systemctl show kdump | grep "LoadState\|UnitFileState"

LoadState=masked
UnitFileState=masked

If the "kdump" service is loaded or active, and is not masked, this is a finding.

Check Content Reference

M

Target Key

5551