diff --git a/kernel.spec b/kernel.spec
index 12f81cbcc..cf8c762e0 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.123.1.el8_10
+%define pkgrelease 553.124.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.123.1%{?dist}
+%define specrelease 553.124.1%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -2707,6 +2707,9 @@ fi
 #
 #
 %changelog
+* Mon May 11 2026 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.124.1.el8_10]
+- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284}
+
 * Mon May 04 2026 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.123.1.el8_10]
 - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187]
 - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187]
diff --git a/sources b/sources
index 7ad7bffea..3afa966a0 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-553.123.1.el8_10.tar.xz) = 1f51acfa8ac4af2f329474f27f93d05ff61a54081b703baa805f00058930a193d4285206ca491a3d6b66cb4fb92db6378f39610d0d79e2e92028213cf125df57
-SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 125322c8ec8eb8f96bd76231692afa5ab2ca1932709585dd312c5e74fa70b2828ff57db0479095628e5b67c9e4c4b7d8cb0d6469a098c8cbd2ca9630d4b784a6
+SHA512 (linux-4.18.0-553.124.1.el8_10.tar.xz) = b605b1ccac76c8188460fd1dc6b7b0675293e110ad3bd4315a3556b39a1f765cc00d4aaf4a99aa9b2f692a26291b3b835118f8538f932e4a6754ed1c5386ee15
+SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 4da243e4ed461084cc393157a6d5aec932411256b010553c5cd888e7bcad100ddebeb34355633cce6a26a66d26f92f9cac787f7963f469ee0216cd61f709e6df
 SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = 79a9788af0c183f670166700354b6a188c176427a6230b8bfaa2cfdc6a4daa1418bbee98d80b7f6b3195043eeef1ffa6782d03b5a1733b65a90c22f66684941f