diff --git a/Makefile.rhelver b/Makefile.rhelver
index 1695f01..b7e9ee9 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 0
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 32
+RHEL_RELEASE = 33
 
 #
 # Early y+1 numbering
diff --git a/kernel-aarch64-debug-rhel.config b/kernel-aarch64-debug-rhel.config
index 7c69d61..6191408 100644
--- a/kernel-aarch64-debug-rhel.config
+++ b/kernel-aarch64-debug-rhel.config
@@ -4516,7 +4516,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-aarch64-rhel.config b/kernel-aarch64-rhel.config
index 25c7d39..ad1dffc 100644
--- a/kernel-aarch64-rhel.config
+++ b/kernel-aarch64-rhel.config
@@ -4495,7 +4495,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-ppc64le-debug-rhel.config b/kernel-ppc64le-debug-rhel.config
index 0823ddd..7b11b3f 100644
--- a/kernel-ppc64le-debug-rhel.config
+++ b/kernel-ppc64le-debug-rhel.config
@@ -4303,7 +4303,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-ppc64le-rhel.config b/kernel-ppc64le-rhel.config
index 3b42f08..2f88fa2 100644
--- a/kernel-ppc64le-rhel.config
+++ b/kernel-ppc64le-rhel.config
@@ -4286,7 +4286,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-s390x-debug-rhel.config b/kernel-s390x-debug-rhel.config
index e620768..b4a59a2 100644
--- a/kernel-s390x-debug-rhel.config
+++ b/kernel-s390x-debug-rhel.config
@@ -4244,7 +4244,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-s390x-rhel.config b/kernel-s390x-rhel.config
index 7c004ca..142d63b 100644
--- a/kernel-s390x-rhel.config
+++ b/kernel-s390x-rhel.config
@@ -4227,7 +4227,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-s390x-zfcpdump-rhel.config b/kernel-s390x-zfcpdump-rhel.config
index 2e27a54..82e8750 100644
--- a/kernel-s390x-zfcpdump-rhel.config
+++ b/kernel-s390x-zfcpdump-rhel.config
@@ -4250,7 +4250,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-x86_64-debug-rhel.config b/kernel-x86_64-debug-rhel.config
index 4c3e462..3854524 100644
--- a/kernel-x86_64-debug-rhel.config
+++ b/kernel-x86_64-debug-rhel.config
@@ -4481,7 +4481,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel-x86_64-rhel.config b/kernel-x86_64-rhel.config
index 1cdac89..834ebb3 100644
--- a/kernel-x86_64-rhel.config
+++ b/kernel-x86_64-rhel.config
@@ -4461,7 +4461,7 @@ CONFIG_RD_LZO=y
 CONFIG_RDMA_SIW=m
 # CONFIG_RDS is not set
 CONFIG_RD_XZ=y
-# CONFIG_RD_ZSTD is not set
+CONFIG_RD_ZSTD=y
 # CONFIG_READABLE_ASM is not set
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 CONFIG_REALTEK_AUTOPM=y
diff --git a/kernel.spec b/kernel.spec
index 546c9f4..0d8c10a 100755
--- a/kernel.spec
+++ b/kernel.spec
@@ -85,7 +85,7 @@ Summary: The Linux kernel
 #  the --with-release option overrides this setting.)
 %define debugbuildsenabled 1
 
-%global distro_build 32
+%global distro_build 33
 
 %if 0%{?fedora}
 %define secure_boot_arch x86_64
@@ -129,13 +129,13 @@ Summary: The Linux kernel
 %define kversion 5.14
 
 %define rpmversion 5.14.0
-%define pkgrelease 32.el9
+%define pkgrelease 33.el9
 
 # This is needed to do merge window version magic
 %define patchlevel 14
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 32%{?buildid}%{?dist}
+%define specrelease 33%{?buildid}%{?dist}
 
 %define pkg_release %{specrelease}
 
@@ -677,7 +677,7 @@ BuildRequires: lld
 # exact git commit you can run
 #
 # xzcat -qq ${TARBALL} | git get-tar-commit-id
-Source0: linux-5.14.0-32.el9.tar.xz
+Source0: linux-5.14.0-33.el9.tar.xz
 
 Source1: Makefile.rhelver
 
@@ -1362,8 +1362,8 @@ ApplyOptionalPatch()
   fi
 }
 
-%setup -q -n kernel-5.14.0-32.el9 -c
-mv linux-5.14.0-32.el9 linux-%{KVERREL}
+%setup -q -n kernel-5.14.0-33.el9 -c
+mv linux-5.14.0-33.el9 linux-%{KVERREL}
 
 cd linux-%{KVERREL}
 cp -a %{SOURCE1} .
@@ -2952,6 +2952,53 @@ fi
 #
 #
 %changelog
+* Thu Dec 16 2021 Herton R. Krzesinski <herton@redhat.com> [5.14.0-33.el9]
+- s390/kexec: handle R_390_PLT32DBL rela in arch_kexec_apply_relocations_add() (Philipp Rudo) [2023155]
+- s390/kexec_file: fix error handling when applying relocations (Philipp Rudo) [2023155]
+- s390/kexec_file: print some more error messages (Philipp Rudo) [2023155]
+- udp: Validate checksum in udp_read_sock() (Xin Long) [2026952]
+- net: udp: correct the document for udp_mem (Xin Long) [2026952]
+- net: udp6: replace __UDP_INC_STATS() with __UDP6_INC_STATS() (Xin Long) [2026952]
+- net: prefer socket bound to interface when not in VRF (Xin Long) [2026952]
+- udp6: allow SO_MARK ctrl msg to affect routing (Xin Long) [2026952]
+- net: udp: annotate data race around udp_sk(sk)->corkflag (Xin Long) [2026952]
+- net/ipv4/udp_tunnel_core.c: remove superfluous header files from udp_tunnel_core.c (Xin Long) [2026952]
+- udp_tunnel: Fix udp_tunnel_nic work-queue type (Xin Long) [2026952]
+- selftests: add a test case for mirred egress to ingress (Hangbin Liu) [2025461]
+- selftests/net: udpgso_bench_rx: fix port argument (Hangbin Liu) [2025461]
+- selftests: net: test_vxlan_under_vrf: fix HV connectivity test (Hangbin Liu) [2025461]
+- selftests: net: tls: remove unused variable and code (Hangbin Liu) [2025461]
+- selftests/net: Fix reuseport_bpf_numa by skipping unavailable nodes (Hangbin Liu) [2025461]
+- selftests: net: switch to socat in the GSO GRE test (Hangbin Liu) [2025461]
+- selftests: net: properly support IPv6 in GSO GRE test (Hangbin Liu) [2025461]
+- kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile (Hangbin Liu) [2025461]
+- kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile (Hangbin Liu) [2025461]
+- kselftests/net: add missed icmp.sh test to Makefile (Hangbin Liu) [2025461]
+- selftests: udp: test for passing SO_MARK as cmsg (Hangbin Liu) [2025461]
+- selftests/net: update .gitignore with newly added tests (Hangbin Liu) [2025461]
+- selftests: net: bridge: update IGMP/MLD membership interval value (Hangbin Liu) [2025461]
+- selftests: lib: forwarding: allow tests to not require mz and jq (Hangbin Liu) [2025461]
+- fcnal-test: kill hanging ping/nettest binaries on cleanup (Hangbin Liu) [2025461]
+- selftests: net/fcnal: Test --{force,no}-bind-key-ifindex (Hangbin Liu) [2025461]
+- selftests: nettest: Add --{force,no}-bind-key-ifindex (Hangbin Liu) [2025461]
+- selftests: forwarding: Add IPv6 GRE hierarchical tests (Hangbin Liu) [2025461]
+- selftests: forwarding: Add IPv6 GRE flat tests (Hangbin Liu) [2025461]
+- testing: selftests: tc_common: Add tc_check_at_least_x_packets() (Hangbin Liu) [2025461]
+- testing: selftests: forwarding.config.sample: Add tc flag (Hangbin Liu) [2025461]
+- selftests: net: fib_nexthops: Wait before checking reported idle time (Hangbin Liu) [2025461]
+- selftest: net: fix typo in altname test (Hangbin Liu) [2025461]
+- selftests: add simple GSO GRE test (Hangbin Liu) [2025461]
+- selftests/net: allow GRO coalesce test on veth (Hangbin Liu) [2025461]
+- selftests/net: Use kselftest skip code for skipped tests (Hangbin Liu) [2025461]
+- tools/net: Use bitwise instead of arithmetic operator for flags (Hangbin Liu) [2025461]
+- selftests: vrf: Add test for SNAT over VRF (Hangbin Liu) [2025461]
+- selftests/net: GRO coalesce test (Hangbin Liu) [2025461]
+- selftests/net: remove min gso test in packet_snd (Hangbin Liu) [2025461]
+- tipc: fix size validations for the MSG_CRYPTO type (Xin Long) [2020513] {CVE-2021-43267}
+- redhat/configs: enable CONFIG_RD_ZSTD for rhel (Tao Liu) [2020132]
+- powerpc/security: Use a mutex for interrupt exit code patching (Steve Best) [2019202]
+- EDAC/mce_amd: Do not load edac_mce_amd module on guests (Aristeu Rozanski) [2000778]
+
 * Thu Dec 16 2021 Herton R. Krzesinski <herton@redhat.com> [5.14.0-32.el9]
 - redhat: configs: explicitly unset CONFIG_DAMON (Rafael Aquini) [2023396]
 - mm/memory_hotplug: restrict CONFIG_MEMORY_HOTPLUG to 64 bit (Rafael Aquini) [2023396]
diff --git a/sources b/sources
index ed41c91..7dd6ee1 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-5.14.0-32.el9.tar.xz) = 4fcba7d14e02c5775e5071f953080770b5b04ab8dbd2a5e8b0b3d685cdf4d56cbffe64cabba959a0005ae715cf1fbce30ef2a22a4f14da6f7854784fbb5d672f
-SHA512 (kernel-abi-stablelists-5.14.0-32.tar.bz2) = 6521635c64b590c597190c175c94dae8800ba61909e0ce196b5c2be340a3e894817c184269a8398ff034dbada4c879bc92c73aa8a7b2eb4c2ad83f22617ba27b
-SHA512 (kernel-kabi-dw-5.14.0-32.tar.bz2) = dfaea33009b1391f05bc0381c5a5600ef54a22264e870450d6867f7461da47cc4876327c29a49b3617a9462fe3879ef54a0ed9362d2705108a4d69a6a808af8e
+SHA512 (linux-5.14.0-33.el9.tar.xz) = 8b956c4aec4f3d2853159e250f7394b0e0289979bda50bb0133192034c7eb2f3e26235ea0ab327a7e8c6e7bee08f98cc366bcd8265287da975808314f8d965c3
+SHA512 (kernel-abi-stablelists-5.14.0-33.tar.bz2) = 1d2ba353f5951a13445b6633116844006d97d1e50304727d133baa14e624908db407ca21b4cec57139268b3bf0b3d529fc90ad25e8daa46f3cdf48885df36611
+SHA512 (kernel-kabi-dw-5.14.0-33.tar.bz2) = 99abd87a7b957f566ef5b359f7e3b13c17b58063e89299821385f8f6b1cc53cdbe6453e82f7e129656db6ee5f001ccb62566253fb64992c75588158855cf8c44