STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must clear memory when it is freed to prevent use-after-free attacks.

DISA Rule

SV-269451r1069342_rule

Vulnerability Number

V-269451

Group Title

SRG-OS-000433-GPOS-00192

Rule Version

ALMA-09-044790

Severity

CAT II

CCI(s)

• CCI-002824 - Implement organization-defined controls to protect its memory from unauthorized code execution.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9 to enable init_on_free with the following command:
$ sudo grubby --update-kernel=ALL --args="init_on_free=1"

Regenerate the GRUB configuration:
$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

Reboot the system:
$ sudo reboot

Check Contents

Verify that GRUB2 is configured to mitigate use-after-free vulnerabilities by employing memory poisoning.

Inspect the "GRUB_CMDLINE_LINUX" entry of /etc/default/grub as follows:
$ sudo grep -i grub_cmdline_linux /etc/default/grub
GRUB_CMDLINE_LINUX="... init_on_free=1"

If "init_on_free=1"is missing or commented out, this is a finding.

Vulnerability Number

V-269451

Documentable

False

Rule Version

ALMA-09-044790

Severity Override Guidance

Verify that GRUB2 is configured to mitigate use-after-free vulnerabilities by employing memory poisoning.

Inspect the "GRUB_CMDLINE_LINUX" entry of /etc/default/grub as follows:
$ sudo grep -i grub_cmdline_linux /etc/default/grub
GRUB_CMDLINE_LINUX="... init_on_free=1"

If "init_on_free=1"is missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5664