diff --git a/Makefile.rhelver b/Makefile.rhelver
index 469c32376..affb2f10c 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 2
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 223
+RHEL_RELEASE = 224
 
 #
 # ZSTREAM
diff --git a/kernel-aarch64-debug-rhel.config b/kernel-aarch64-debug-rhel.config
index 146f26252..61fe13fb0 100644
--- a/kernel-aarch64-debug-rhel.config
+++ b/kernel-aarch64-debug-rhel.config
@@ -1157,6 +1157,7 @@ CONFIG_DEBUG_LOCK_ALLOC=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_NET=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
 CONFIG_DEBUG_OBJECTS_FREE=y
diff --git a/kernel-aarch64-rhel.config b/kernel-aarch64-rhel.config
index 4d5411db1..85c753fd9 100644
--- a/kernel-aarch64-rhel.config
+++ b/kernel-aarch64-rhel.config
@@ -1156,6 +1156,7 @@ CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_DEBUG_OBJECTS_SELFTEST is not set
diff --git a/kernel-ppc64le-debug-rhel.config b/kernel-ppc64le-debug-rhel.config
index 3f8b1dcef..78fe5ee7a 100644
--- a/kernel-ppc64le-debug-rhel.config
+++ b/kernel-ppc64le-debug-rhel.config
@@ -963,6 +963,7 @@ CONFIG_DEBUG_LOCK_ALLOC=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_NET=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
 CONFIG_DEBUG_OBJECTS_FREE=y
diff --git a/kernel-ppc64le-rhel.config b/kernel-ppc64le-rhel.config
index f10c9aa95..266dbb483 100644
--- a/kernel-ppc64le-rhel.config
+++ b/kernel-ppc64le-rhel.config
@@ -962,6 +962,7 @@ CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_DEBUG_OBJECTS_SELFTEST is not set
diff --git a/kernel-s390x-debug-rhel.config b/kernel-s390x-debug-rhel.config
index 2e33084d3..a790f5755 100644
--- a/kernel-s390x-debug-rhel.config
+++ b/kernel-s390x-debug-rhel.config
@@ -971,6 +971,7 @@ CONFIG_DEBUG_LOCK_ALLOC=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_NET=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
 CONFIG_DEBUG_OBJECTS_FREE=y
diff --git a/kernel-s390x-rhel.config b/kernel-s390x-rhel.config
index 2dba9aa37..ab8ff059e 100644
--- a/kernel-s390x-rhel.config
+++ b/kernel-s390x-rhel.config
@@ -970,6 +970,7 @@ CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_DEBUG_OBJECTS_SELFTEST is not set
diff --git a/kernel-s390x-zfcpdump-rhel.config b/kernel-s390x-zfcpdump-rhel.config
index 1dfa7efac..921ab639f 100644
--- a/kernel-s390x-zfcpdump-rhel.config
+++ b/kernel-s390x-zfcpdump-rhel.config
@@ -976,6 +976,7 @@ CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_MISC is not set
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_DEBUG_OBJECTS_SELFTEST is not set
diff --git a/kernel-x86_64-debug-rhel.config b/kernel-x86_64-debug-rhel.config
index d71ad685d..a7102e267 100644
--- a/kernel-x86_64-debug-rhel.config
+++ b/kernel-x86_64-debug-rhel.config
@@ -1022,6 +1022,7 @@ CONFIG_DEBUG_LOCK_ALLOC=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_NET=y
 # CONFIG_DEBUG_NMI_SELFTEST is not set
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
diff --git a/kernel-x86_64-rhel.config b/kernel-x86_64-rhel.config
index 10de4c39c..0b908a151 100644
--- a/kernel-x86_64-rhel.config
+++ b/kernel-x86_64-rhel.config
@@ -1021,6 +1021,7 @@ CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 CONFIG_DEBUG_MISC=y
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
 # CONFIG_DEBUG_NMI_SELFTEST is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_DEBUG_OBJECTS is not set
diff --git a/kernel.spec b/kernel.spec
index 82206d359..3b5286441 100755
--- a/kernel.spec
+++ b/kernel.spec
@@ -119,15 +119,15 @@ Summary: The Linux kernel
 # define buildid .local
 %define specversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 223
+%define pkgrelease 224
 %define kversion 5
-%define tarfile_release 5.14.0-223.el9
+%define tarfile_release 5.14.0-224.el9
 # This is needed to do merge window version magic
 %define patchlevel 14
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 223%{?buildid}%{?dist}
+%define specrelease 224%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 5.14.0-223.el9
+%define kabiversion 5.14.0-224.el9
 
 #
 # End of genspec.sh variables
@@ -3110,6 +3110,114 @@ fi
 #
 #
 %changelog
+* Thu Dec 22 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-224.el9]
+- tls: strp: make sure the TCP skbs do not have overlapping data (Sabrina Dubroca) [2143700]
+- selftests: tls: handful of memrnd() and length checks (Sabrina Dubroca) [2143700]
+- selftests: tls: add a test for timeo vs lock (Sabrina Dubroca) [2143700]
+- selftests: tls: add test for NoPad getsockopt (Sabrina Dubroca) [2143700]
+- selftests: tls: add selftest variant for pad (Sabrina Dubroca) [2143700]
+- selftests: tls: skip cmsg_to_pipe tests with TLS=n (Sabrina Dubroca) [2143700]
+- selftests: tls: test for correct proto_ops (Sabrina Dubroca) [2143700]
+- selftests: tls: test splicing decrypted records (Sabrina Dubroca) [2143700]
+- selftests: tls: test splicing cmsgs (Sabrina Dubroca) [2143700]
+- tls: rx: react to strparser initialization errors (Sabrina Dubroca) [2143700]
+- net/tls: Use RCU API to access tls_ctx->netdev (Sabrina Dubroca) [2143700]
+- tls: rx: device: don't try to copy too much on detach (Sabrina Dubroca) [2143700]
+- tls: rx: device: bound the frag walk (Sabrina Dubroca) [2143700]
+- net/tls: Remove redundant workqueue flush before destroy (Sabrina Dubroca) [2143700]
+- net/tls: Multi-threaded calls to TX tls_dev_del (Sabrina Dubroca) [2143700]
+- net/tls: Perform immediate device ctx cleanup when possible (Sabrina Dubroca) [2143700]
+- tls: rx: fix the false positive warning (Sabrina Dubroca) [2143700]
+- tls: strp: rename and multithread the workqueue (Sabrina Dubroca) [2143700]
+- tls: rx: don't consider sock_rcvtimeo() cumulative (Sabrina Dubroca) [2143700]
+- tls: rx: Fix unsigned comparison with less than zero (Sabrina Dubroca) [2143700]
+- tls: rx: do not use the standard strparser (Sabrina Dubroca) [2143700]
+- tls: rx: device: add input CoW helper (Sabrina Dubroca) [2143700]
+- tcp: allow tls to decrypt directly from the tcp rcv queue (Sabrina Dubroca) [2143700]
+- tcp: avoid indirect calls to sock_rfree (Sabrina Dubroca) [2143700]
+- tls: rx: device: keep the zero copy status with offload (Sabrina Dubroca) [2143700]
+- tls: rx: don't free the output in case of zero-copy (Sabrina Dubroca) [2143700]
+- redhat/configs: enable CONFIG_DEBUG_NET for debug kernel (Sabrina Dubroca) [2143700]
+- net: add CONFIG_DEBUG_NET (Sabrina Dubroca) [2143700]
+- net: add include/net/net_debug.h (Sabrina Dubroca) [2143700]
+- tls: rx: factor SW handling out of tls_rx_one_record() (Sabrina Dubroca) [2143700]
+- tls: rx: wrap recv_pkt accesses in helpers (Sabrina Dubroca) [2143700]
+- net/tls: Remove the context from the list in tls_device_down (Sabrina Dubroca) [2143700]
+- tls: rx: release the sock lock on locking timeout (Sabrina Dubroca) [2143700]
+- tls: rx: decrypt into a fresh skb (Sabrina Dubroca) [2143700]
+- tls: rx: async: don't put async zc on the list (Sabrina Dubroca) [2143700]
+- tls: rx: async: hold onto the input skb (Sabrina Dubroca) [2143700]
+- tls: rx: async: adjust record geometry immediately (Sabrina Dubroca) [2143700]
+- tls: rx: return the decrypted skb via darg (Sabrina Dubroca) [2143700]
+- tls: rx: read the input skb from ctx->recv_pkt (Sabrina Dubroca) [2143700]
+- tls: rx: factor out device darg update (Sabrina Dubroca) [2143700]
+- tls: rx: remove the message decrypted tracking (Sabrina Dubroca) [2143700]
+- tls: rx: don't keep decrypted skbs on ctx->recv_pkt (Sabrina Dubroca) [2143700]
+- tls: rx: don't try to keep the skbs always on the list (Sabrina Dubroca) [2143700]
+- tls: rx: allow only one reader at a time (Sabrina Dubroca) [2143700]
+- net/tls: Fix race in TLS device down flow (Sabrina Dubroca) [2143700]
+- net/tls: Check for errors in tls_device_init (Sabrina Dubroca) [2143700]
+- tls: rx: fix the NoPad getsockopt (Sabrina Dubroca) [2143700]
+- tls: rx: add counter for NoPad violations (Sabrina Dubroca) [2143700]
+- tls: fix spelling of MIB (Sabrina Dubroca) [2143700]
+- tls: rx: make tls_wait_data() return an recvmsg retcode (Sabrina Dubroca) [2143700]
+- tls: create an internal header (Sabrina Dubroca) [2143700]
+- tls: rx: coalesce exit paths in tls_decrypt_sg() (Sabrina Dubroca) [2143700]
+- tls: rx: wrap decrypt params in a struct (Sabrina Dubroca) [2143700]
+- tls: rx: always allocate max possible aad size for decrypt (Sabrina Dubroca) [2143700]
+- strparser: pad sk_skb_cb to avoid straddling cachelines (Sabrina Dubroca) [2143700]
+- tls: rx: periodically flush socket backlog (Sabrina Dubroca) [2143700]
+- tls: rx: add sockopt for enabling optimistic decrypt with TLS 1.3 (Sabrina Dubroca) [2143700]
+- docs: tls: document the TLS_TX_ZEROCOPY_RO (Sabrina Dubroca) [2143700]
+- tls: rx: support optimistic decrypt to user buffer with TLS 1.3 (Sabrina Dubroca) [2143700]
+- tls: rx: don't include tail size in data_len (Sabrina Dubroca) [2143700]
+- Revert "tls: rx: move counting TlsDecryptErrors for sync" (Sabrina Dubroca) [2143700]
+- tls: Rename TLS_INFO_ZC_SENDFILE to TLS_INFO_ZC_TX (Sabrina Dubroca) [2143700]
+- net: tls: fix messing up lists when bpf enabled (Sabrina Dubroca) [2143700]
+- tls: Add opt-in zerocopy mode of sendfile() (Sabrina Dubroca) [2143700]
+- tls: Fix context leak on tls_device_down (Sabrina Dubroca) [2143700]
+- tls: Skip tls_append_frag on zero copy size (Sabrina Dubroca) [2143700]
+- net: tls: fix async vs NIC crypto offload (Sabrina Dubroca) [2143700]
+- tls: rx: only copy IV from the packet for TLS 1.2 (Sabrina Dubroca) [2143700]
+- tls: rx: use MAX_IV_SIZE for allocations (Sabrina Dubroca) [2143700]
+- tls: rx: use async as an in-out argument (Sabrina Dubroca) [2143700]
+- tls: rx: return the already-copied data on crypto error (Sabrina Dubroca) [2143700]
+- tls: rx: treat process_rx_list() errors as transient (Sabrina Dubroca) [2143700]
+- tls: rx: assume crypto always calls our callback (Sabrina Dubroca) [2143700]
+- tls: rx: don't handle TLS 1.3 in the async crypto callback (Sabrina Dubroca) [2143700]
+- tls: rx: move counting TlsDecryptErrors for sync (Sabrina Dubroca) [2143700]
+- tls: rx: reuse leave_on_list label for psock (Sabrina Dubroca) [2143700]
+- tls: rx: consistently use unlocked accessors for rx_list (Sabrina Dubroca) [2143700]
+- tls: rx: jump out for cases which need to leave skb on list (Sabrina Dubroca) [2143700]
+- tls: rx: clear ctx->recv_pkt earlier (Sabrina Dubroca) [2143700]
+- tls: rx: inline consuming the skb at the end of the loop (Sabrina Dubroca) [2143700]
+- tls: rx: pull most of zc check out of the loop (Sabrina Dubroca) [2143700]
+- tls: rx: don't track the async count (Sabrina Dubroca) [2143700]
+- tls: rx: don't handle async in tls_sw_advance_skb() (Sabrina Dubroca) [2143700]
+- tls: rx: factor out writing ContentType to cmsg (Sabrina Dubroca) [2143700]
+- tls: rx: simplify async wait (Sabrina Dubroca) [2143700]
+- tls: rx: wrap decryption arguments in a structure (Sabrina Dubroca) [2143700]
+- tls: rx: don't report text length from the bowels of decrypt (Sabrina Dubroca) [2143700]
+- tls: rx: drop unnecessary arguments from tls_setup_from_iter() (Sabrina Dubroca) [2143700]
+- tls: hw: rx: use return value of tls_device_decrypted() to carry status (Sabrina Dubroca) [2143700]
+- tls: rx: refactor decrypt_skb_update() (Sabrina Dubroca) [2143700]
+- tls: rx: don't issue wake ups when data is decrypted (Sabrina Dubroca) [2143700]
+- tls: rx: replace 'back' with 'offset' (Sabrina Dubroca) [2143700]
+- tls: rx: use a define for tag length (Sabrina Dubroca) [2143700]
+- tls: rx: init decrypted status in tls_read_size() (Sabrina Dubroca) [2143700]
+- tls: rx: don't store the decryption status in socket context (Sabrina Dubroca) [2143700]
+- tls: rx: don't store the record type in socket context (Sabrina Dubroca) [2143700]
+- tls: rx: drop pointless else after goto (Sabrina Dubroca) [2143700]
+- tls: rx: jump to a more appropriate label (Sabrina Dubroca) [2143700]
+- net/tls: optimize judgement processes in tls_set_device_offload() (Sabrina Dubroca) [2143700]
+- net/tls: remove unnecessary jump instructions in do_tls_setsockopt_conf() (Sabrina Dubroca) [2143700]
+- net/tls: Provide {__,}tls_driver_ctx() unconditionally (Sabrina Dubroca) [2143700]
+- net/tls: simplify the tls_set_sw_offload function (Sabrina Dubroca) [2143700]
+- net/tls: getsockopt supports complete algorithm list (Sabrina Dubroca) [2143700]
+- net/tls: tls_crypto_context add supported algorithms context (Sabrina Dubroca) [2143700]
+- net/tls: support SM4 CCM algorithm (Sabrina Dubroca) [2143700]
+- net/tls: support SM4 GCM/CCM algorithm (Sabrina Dubroca) [2143700]
+
 * Thu Dec 22 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-223.el9]
 - pwm: tegra: Ensure the clock rate is not less than needed (d.marlin) [2141743]
 - pwm: tegra: Improve required rate calculation (d.marlin) [2141743]
diff --git a/sources b/sources
index b4d8cc2ad..684b0760a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-5.14.0-223.el9.tar.xz) = 399fd3d6f3f2628806363b7bf619db6458e1c8ac42ad48cf04ef2a746a52ef9036bf61ab32d6d131e0def8371a1165469db2d7e0d7f3cccf3e4167ce0bdd73bb
-SHA512 (kernel-abi-stablelists-5.14.0-223.el9.tar.bz2) = 29b2957d256c27dd33f288365ab21bff7f9ddc18ccccd3706ff26dde108d09d72f3da23df479ce2c3ca27afc4c404c66710f7ad23174bf6e805226980ddeda33
-SHA512 (kernel-kabi-dw-5.14.0-223.el9.tar.bz2) = d649ee286f8e5d8fe0aa1bbb9878a10821ba9826682c4ae21c5749cf7063e7980e9c5df9a91764b52092690b1e9e3274f7c749504f084a8691a7ca33c4c11f18
+SHA512 (linux-5.14.0-224.el9.tar.xz) = c983af59908572c086cb663cd675cca3b3105e00a5bb8591bde07ecb72f1cc61abdb07e5b90f76b7a39bad292259f5bcefb8ceec978b4f4720a82b9984bc9f2b
+SHA512 (kernel-abi-stablelists-5.14.0-224.el9.tar.bz2) = 5f274333f91d294efd6d3a8675b8f040d68b392a7900f2771cd8d8e27b04e93b25bb5ede3e692b4d7b2183a8d76d44d9a90b7e5b25d6c279dc84b69e0cf16bff
+SHA512 (kernel-kabi-dw-5.14.0-224.el9.tar.bz2) = e6f282222bbb72b22d343400f96722525c6662787a2e289ca4f2e93eb36cce671a7e9ac1de2e1994e9b058d5958ba62d0cb9abfc3709b57f667002a47254e21c