diff --git a/kernel.spec b/kernel.spec
index c7a3514..246dcbc 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -49,10 +49,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.161.1.rt7.502.el8_10
+%define pkgrelease 553.162.1.rt7.503.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.161.1.rt7.502%{?dist}
+%define specrelease 553.162.1.rt7.503%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -161,7 +161,7 @@
 # The preempt RT patch level
 %global rttag .rt7
 # realtimeN
-%global rtbuild .502
+%global rtbuild .503
 %define with_doc 0
 %define with_headers 0
 %define with_cross_headers 0
@@ -2800,6 +2800,24 @@ fi
 #
 #
 %changelog
+* Wed Sep 09 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.162.1.rt7.503.el8_10]
+- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117]
+- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801}
+- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117}
+- sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971}
+- sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917}
+- sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315}
+- sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376}
+- sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300}
+- gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340]
+- gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340]
+- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202]
+- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246}
+- netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942}
+- netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986}
+- scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745}
+- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149}
+
 * Mon Sep 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.161.1.rt7.502.el8_10]
 - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015}
 - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113}
diff --git a/sources b/sources
index 68cbc9d..6c5e2a1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (linux-4.18.0-553.161.1.rt7.502.el8_10.tar.xz) = dc32ce520b498ef52e3ee41794675f4cc4d516e2e8e18fd281a337ae15dba079b102ac8b5e519f1adc9dafb8be659a7ee2687f54e797a7f82b2756ce86e7d4ae
+SHA512 (linux-4.18.0-553.162.1.rt7.503.el8_10.tar.xz) = 68a844b31d674c87290e39d90d24575d7743b2b907420654c9c8950ee0cebf1048b17ea32c6f9d484c0a478e2d8481d44d87c69fcb1c8c020eea38ee766a2d66