diff --git a/COPYING-5.14.0-611.34.1.el9 b/COPYING-5.14.0-611.35.1.el9
similarity index 100%
rename from COPYING-5.14.0-611.34.1.el9
rename to COPYING-5.14.0-611.35.1.el9
diff --git a/Makefile.rhelver b/Makefile.rhelver
index cd2d0ea68c..6ea0bba4c1 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 7
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 611.34.1
+RHEL_RELEASE = 611.35.1
 
 #
 # ZSTREAM
diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c
index 705710f93e..0e05c6b5a2 100644
--- a/fs/exfat/nls.c
+++ b/fs/exfat/nls.c
@@ -804,4 +804,5 @@ load_default:
 void exfat_free_upcase_table(struct exfat_sb_info *sbi)
 {
 	kvfree(sbi->vol_utbl);
+	sbi->vol_utbl = NULL;
 }
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index 8a8412a7b2..16d5f2a493 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -145,9 +145,9 @@ u64 *page_pool_ethtool_stats_get(u64 *data, const void *stats)
 EXPORT_SYMBOL(page_pool_ethtool_stats_get);
 
 #else
-#define alloc_stat_inc(pool, __stat)
-#define recycle_stat_inc(pool, __stat)
-#define recycle_stat_add(pool, __stat, val)
+#define alloc_stat_inc(...)	do { } while (0)
+#define recycle_stat_inc(...)	do { } while (0)
+#define recycle_stat_add(...)	do { } while (0)
 #endif
 
 static bool page_pool_producer_lock(struct page_pool *pool)
@@ -679,19 +679,16 @@ void page_pool_return_page(struct page_pool *pool, struct page *page)
 
 static bool page_pool_recycle_in_ring(struct page_pool *pool, struct page *page)
 {
-	int ret;
+	bool in_softirq, ret;
+
 	/* BH protection not needed if current is softirq */
-	if (in_softirq())
-		ret = ptr_ring_produce(&pool->ring, page);
-	else
-		ret = ptr_ring_produce_bh(&pool->ring, page);
-
-	if (!ret) {
+	in_softirq = page_pool_producer_lock(pool);
+	ret = !__ptr_ring_produce(&pool->ring, page);
+	if (ret)
 		recycle_stat_inc(pool, ring);
-		return true;
-	}
+	page_pool_producer_unlock(pool, in_softirq);
 
-	return false;
+	return ret;
 }
 
 /* Only allow direct recycling in special circumstances, into the
@@ -1023,10 +1020,14 @@ static void page_pool_scrub(struct page_pool *pool)
 
 static int page_pool_release(struct page_pool *pool)
 {
+	bool in_softirq;
 	int inflight;
 
 	page_pool_scrub(pool);
 	inflight = page_pool_inflight(pool, true);
+	/* Acquire producer lock to make sure producers have exited. */
+	in_softirq = page_pool_producer_lock(pool);
+	page_pool_producer_unlock(pool, in_softirq);
 	if (!inflight)
 		__page_pool_destroy(pool);
 
diff --git a/redhat/kernel.changelog-9.7 b/redhat/kernel.changelog-9.7
index 3a97779a7f..f431471a80 100644
--- a/redhat/kernel.changelog-9.7
+++ b/redhat/kernel.changelog-9.7
@@ -1,3 +1,8 @@
+* Tue Feb 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.35.1.el9_7]
+- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Paolo Abeni) [RHEL-137841] {CVE-2025-38129}
+- exfat: fix double free in delayed_free (CKI Backport Bot) [RHEL-146403] {CVE-2025-38206}
+Resolves: RHEL-137841, RHEL-146403
+
 * Sat Feb 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.34.1.el9_7]
 - scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-145183]
 - smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-127498]