STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces by default.

DISA Rule

SV-281358r1167224_rule

Vulnerability Number

V-281358

Group Title

SRG-OS-000420-GPOS-00186

Rule Version

RHEL-10-800260

Severity

CAT II

CCI(s)

CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
CCI-001113 - Defines the internal communications traffic to be routed to external networks.

Weight

Fix Recommendation

Configure RHEL 10 to not accept router advertisements on all IPv6 interfaces by default, unless the system is a router.

Create a configuration file if it does not already exist:

$ sudo vi /etc/sysctl.d/ipv6_accept_ra.conf

Add the following line to the file:

net.ipv6.conf.default.accept_ra = 0

Reload settings from all system configuration files with the following command:

$ sudo sysctl --system

Check Contents

Note: If IPv6 is disabled on the system, this requirement is not applicable.

Verify RHEL 10 does not accept router advertisements on all IPv6 interfaces by default, unless the system is a router.

Check the value of the "net.ipv6.conf.default.accept_ra" variable with the following command:

$ sudo sysctl net.ipv6.conf.default.accept_ra
net.ipv6.conf.default.accept_ra = 0

If "net.ipv6.conf.default.accept_ra" is not set to "0" or is missing, this is a finding.

Vulnerability Number

V-281358

Documentable

False

Rule Version

RHEL-10-800260

Severity Override Guidance

Check Content Reference

Target Key

5733