diff --git a/kernel.spec b/kernel.spec
index e07fce4..4d93ad6 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -12,7 +12,7 @@
 # change below to w4T.xzdio):
 %define _binary_payload w3T.xzdio
 
-%global distro_build 537
+%global distro_build 538
 
 # Sign the x86_64 kernel for secure boot authentication
 %ifarch x86_64 aarch64 s390x ppc64le
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 537.rt7.326.el8
+%define pkgrelease 538.rt7.327.el8
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 537.rt7.326%{?dist}
+%define specrelease 538.rt7.327%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -147,7 +147,7 @@
 # The preempt RT patch level
 %global rttag .rt7
 # realtimeN
-%global rtbuild .326
+%global rtbuild .327
 %define with_doc 0
 %define with_headers 0
 %define with_cross_headers 0
@@ -2698,6 +2698,28 @@ fi
 #
 #
 %changelog
+* Wed Jan 31 2024 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-538.rt7.327.el8]
+- [rt] build kernel-rt-4.18.0-538.rt7.327.el8 [RHEL-5332]
+- ida: Fix crash in ida_free when the bitmap is empty (Wander Lairson Costa) [RHEL-19681] {CVE-2023-6915}
+- mm: create a new system state and fix core_kernel_text() (Joel Savitz) [RHEL-5227]
+- redhat: rewrite genlog and support Y- tags (Jan Stancek)
+- Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" (Nigel Croxon) [RHEL-22698]
+- Revert "x86/fpu/xstate: Fix PKRU covert channel" (Steve Best) [RHEL-22192]
+- net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-19065] {CVE-2024-0646}
+- smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-18990] {CVE-2023-6606}
+- smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-19144] {CVE-2023-6610}
+- smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-19144] {CVE-2023-6610}
+- ovl: skip stale entries in merge dir cache iteration (Miklos Szeredi) [RHEL-18076]
+- ovl: invalidate readdir cache on changes to dir with origin (Miklos Szeredi) [RHEL-18076]
+- ipv6: avoid atomic fragment on GSO packets (Hangbin Liu) [RHEL-22149]
+- ipv6: fix potential NULL deref in fib6_add() (Hangbin Liu) [RHEL-22149]
+- lockdep: Fix block chain corruption (Joel Savitz) [RHEL-5227]
+- futex: Don't include process MM in futex key on no-MMU (Joel Savitz) [RHEL-5227]
+- locking/rtmutex: Fix task->pi_waiters integrity (Joel Savitz) [RHEL-5227]
+- locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers (Joel Savitz) [RHEL-5227]
+- locking/rwsem: Disable preemption in all down_write*() and up_write() code paths (Joel Savitz) [RHEL-5227]
+- mm: make generic arch_is_kernel_initmem_freed() do what it says (Joel Savitz) [RHEL-5227]
+
 * Wed Jan 24 2024 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-537.rt7.326.el8]
 - [rt] build kernel-rt-4.18.0-537.rt7.326.el8 [RHEL-5332]
 - cgroup/cpuset: Inherit parent's load balance state in v2 (Waiman Long) [RHEL-12873]
diff --git a/sources b/sources
index a7baeaa..dc10e1d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (linux-4.18.0-537.rt7.326.el8.tar.xz) = 9989cc964d041003da227e66ee061b3bfd252e46f35d7d4cf411b84fc66e6a642bb766ccbfcd7774efe43d6a291caaa3e406eee9a61b1ab7ca22a3b856d8e7d4
+SHA512 (linux-4.18.0-538.rt7.327.el8.tar.xz) = 8a0da50f1d180e2285ef3bcd76bb60e5dc13f4dad604f42fa2eb7f245d19609c3874c4b2d57d4f8936b1e976f90a4cc3f1df47bde94f6c9194c295a20d77fdd8