diff --git a/gvisor-tap-vsock.spec b/gvisor-tap-vsock.spec
index 9b2b449..0020da0 100644
--- a/gvisor-tap-vsock.spec
+++ b/gvisor-tap-vsock.spec
@@ -27,7 +27,7 @@ Epoch: 6
 # If you're reading this on dist-git, the version is automatically filled in by Packit.
 Version: 0.8.6
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT
-Release: 1%{?dist}
+Release: 2%{?dist}
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
@@ -115,6 +115,10 @@ install -p -m0755 bin/gvforwarder %{buildroot}%{_gvisor_installdir}
 %{_gvisor_installdir}/gvforwarder
 
 %changelog
+* Wed Jun 11 2025 Jindrich Novy <jnovy@redhat.com> - 6:0.8.6-2
+- rebuild for CVE-2025-22871
+- Resolves: RHEL-90008
+
 * Fri May 09 2025 Jindrich Novy <jnovy@redhat.com> - 6:0.8.6-1
 - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.6
 - Related: RHEL-80817