diff --git a/kernel.spec b/kernel.spec
index a1f6617..ed42a39 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -49,10 +49,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.145.1.rt7.486.el8_10
+%define pkgrelease 553.146.1.rt7.487.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.145.1.rt7.486%{?dist}
+%define specrelease 553.146.1.rt7.487%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -159,7 +159,7 @@
 # The preempt RT patch level
 %global rttag .rt7
 # realtimeN
-%global rtbuild .486
+%global rtbuild .487
 %define with_doc 0
 %define with_headers 0
 %define with_cross_headers 0
@@ -2726,6 +2726,10 @@ fi
 #
 #
 %changelog
+* Mon Jul 20 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.146.1.rt7.487.el8_10]
+- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117}
+- PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916]
+
 * Thu Jul 16 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.145.1.rt7.486.el8_10]
 - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071}
 
diff --git a/sources b/sources
index 47c16e0..8a35332 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (linux-4.18.0-553.145.1.rt7.486.el8_10.tar.xz) = 9f8e8b52c9c39338087dc9f9ce16f67c3e02d443de3cbc64c5dc7bdaa4a9a68cb421b047396b3e986363444064751cfe8ce6c3199378682903687486f9c508a9
+SHA512 (linux-4.18.0-553.146.1.rt7.487.el8_10.tar.xz) = c3277280c0ddaae474f4995cbd4d1e2aa02d08c67d6c323ffcd25b86404ffb73356e8038648778588d4a9b625d596f707d021fce76c2094ed785e8724ff1fe4f