This advisory covers four distinct vulnerabilities in the Linux kernel as packaged by Red Hat for Enterprise Linux 10.0 EUS and related products. CVE-2026-23066 is a denial of service vulnerability via unsafe requeue in rxrpc_recvmsg. CVE-2026-23193 fixes a use-after-free in iscsit_dec_session_usage_count() within the SCSI target iscsi code. CVE-2026-23156 addresses an information disclosure issue in efivarfs caused by incorrect error propagation. CVE-2026-23231 involves a use-after-free in nf_tables_addchain() that can lead to privilege escalation or denial of service. Red Hat has issued a security update (RHSA-2026:9095) that mitigates these vulnerabilities. The update applies to multiple architectures and requires a reboot for the fixes to be effective.

The vulnerabilities collectively allow for denial of service, information disclosure, and privilege escalation on affected systems running the vulnerable Linux kernel versions. Exploitation could disrupt system availability, leak sensitive information, or allow attackers to gain elevated privileges. The advisory rates the overall security impact as Moderate (medium severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released an official security update (RHSA-2026:9095) that addresses these vulnerabilities. Users should apply the updated kernel packages for Red Hat Enterprise Linux 10.0 Extended Update Support and related products as soon as possible. A system reboot is required for the update to take effect. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.