documentation_complete: true


title: 'Enable Kernel Page-Table Isolation (KPTI)'

description: |-
    To enable Kernel page-table isolation,
    add the argument <tt>pti=on</tt> to the default
    GRUB 2 command line for the Linux operating system.
    {{{ describe_grub2_argument("pti=on") | indent(4) }}}

rationale: |-
    Kernel page-table isolation is a kernel feature that mitigates
    the Meltdown security vulnerability and hardens the kernel
    against attempts to bypass kernel address space layout
    randomization (KASLR).

severity: low

identifiers:
    cce@rhel8: CCE-82194-2
    cce@rhel9: CCE-83843-3
    cce@rhel10: CCE-88971-7

references:
    nist: SI-16
    srg: SRG-OS-000433-GPOS-00193,SRG-OS-000095-GPOS-00049
    stigid@ol8: OL08-00-040004

ocil_clause: 'Kernel page-table isolation is not enabled'

ocil: |-
    {{{ ocil_grub2_argument("pti=on") | indent(4) }}}


template:
    name: grub2_bootloader_argument
    vars:
        arg_name: pti
        arg_value: 'on'

fixtext: |-
    {{{ describe_grub2_argument("pti=on") | indent(4) }}}

srg_requirement:
  {{{ full_name }}} must enable mitigations against processor-based vulnerabilities.
