STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must disable the kdump service.

DISA Rule

SV-281322r1167116_rule

Vulnerability Number

V-281322

Group Title

SRG-OS-000269-GPOS-00103

Rule Version

RHEL-10-701200

Severity

CAT II

CCI(s)

• CCI-001665 - Preserve organization-defined system state information in the event of a system failure.

Weight

10

Fix Recommendation

Configure RHEL 10 to disable and mask the kdump service.

To disable the kdump service, run the following command:

$ sudo systemctl disable --now kdump
Removed '/etc/systemd/system/multi-user.target.wants/kdump.service'.

To mask the kdump service, run the following command:

$ sudo systemctl mask --now kdump
Created symlink '/etc/systemd/system/kdump.service' ? '/dev/null'.

Check Contents

Verify RHEL 10 disables the kdump service in system boot configuration with the following command:

$ sudo systemctl is-enabled kdump
masked

Verify the kdump service is not active (i.e., not running) through current runtime configuration with the following command:

$ sudo systemctl is-active kdump
failed

Verify the kdump service is masked with the following command:

$ sudo systemctl show kdump | grep "LoadState\|UnitFileState"
LoadState=masked
UnitFileState=masked

If the "kdump" service is loaded or active and is not masked, this is a finding.

Vulnerability Number

V-281322

Documentable

False

Rule Version

RHEL-10-701200

Severity Override Guidance

Verify RHEL 10 disables the kdump service in system boot configuration with the following command:

$ sudo systemctl is-enabled kdump
masked

Verify the kdump service is not active (i.e., not running) through current runtime configuration with the following command:

$ sudo systemctl is-active kdump
failed

Verify the kdump service is masked with the following command:

$ sudo systemctl show kdump | grep "LoadState\|UnitFileState"
LoadState=masked
UnitFileState=masked

If the "kdump" service is loaded or active and is not masked, this is a finding.

Check Content Reference

M

Target Key

5733