Forbid loading another kernel while running

Why it matters

kexec lets the running kernel load and jump into another kernel without going through the firmware. An attacker who has already gained administrator rights could use it to start a kernel they prepared, one that ignores your security settings or hides their tools. Switching it off removes that step.

How it works

Sets kernel.kexec_load_disabled to 1, which disables the kexec_load and kexec_file_load system calls. The kernel documentation states that after it is set to 1 it cannot be set back to 0 until the next reboot.

Who should use it

Suitable for desktops and servers that do not use kexec. Leave it off if you rely on kdump crash capture, kexec-based fast reboots, or live kernel update tools.

What you may notice

Commands such as kexec -l fail with a permission error, and a crash-kernel service that starts after the setting is applied may fail to load. Only a reboot reverses it.

Check it on your computer

Read the current value:

sysctl kernel.kexec_load_disabled

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.kexec_load_disabled=1

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-kexec.conf <<'EOF'
kernel.kexec_load_disabled = 1
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Turn off the SysRq emergency keys

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

kernel.kexec_load_disabled