This advisory covers six kernel vulnerabilities in Red Hat Enterprise Linux 9.6 Extended Update Support. CVE-2026-23066 involves a denial of service via unsafe requeue in rxrpc_recvmsg. CVE-2026-23111 allows privilege escalation or denial of service due to an inverted element activity check in nf_tables. CVE-2026-23144 causes local denial of service and memory leak in DAMON sysfs via setup failure. CVE-2026-23171 is a use-after-free in the bonding module that can lead to system crash or arbitrary code execution. CVE-2026-23193 fixes a use-after-free in iscsit_dec_session_usage_count() within the iscsi target. CVE-2026-23204 addresses a network scheduler issue by using skb_header_pointer_careful(). The update is provided by Red Hat Product Security and requires rebooting the system after installation.

The vulnerabilities collectively can cause denial of service conditions, local privilege escalation, memory leaks, system crashes, and potentially arbitrary code execution. These impacts affect the stability and security of the Linux kernel on affected Red Hat Enterprise Linux 9.6 systems. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for Red Hat Enterprise Linux 9.6 Extended Update Support that addresses these vulnerabilities. Users should apply the kernel update as described in the Red Hat advisory (RHSA-2026:9112) and reboot their systems to ensure the fixes take effect. Patch status is confirmed by the vendor advisory. No additional mitigation beyond applying the update and rebooting is indicated.