diff --git a/Makefile.rhelver b/Makefile.rhelver
index 8f9764f57..80fa0f222 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 3
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 216
+RHEL_RELEASE = 217
 
 #
 # RHEL_REBASE_NUM
diff --git a/kernel.changelog b/kernel.changelog
index 87fc1986b..0b2f070c0 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,27 @@
+* Mon Mar 30 2026 Alexandra Hájková <ahajkova@redhat.com> [6.12.0-217.el10]
+- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154397]
+- smb/client: remove unused SMB311_posix_query_info() (Paulo Alcantara) [RHEL-154397]
+- smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() (Paulo Alcantara) [RHEL-154397]
+- smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() (Paulo Alcantara) [RHEL-154397]
+- ACPI: AGDI: Add interrupt signaling mode support (Charles Mirabile) [RHEL-111893]
+- add xxd to as BuildRequire for bpf selftests (Ines Qian) [RHEL-157473]
+- selftests/net: test ipip packets in gro.sh (Antoine Tenart) [RHEL-123213]
+- net: gro: remove unnecessary df checks (Antoine Tenart) [RHEL-123213]
+- net: gso: restore ids of outer ip headers correctly (Antoine Tenart) [RHEL-123213]
+- net: gro: only merge packets with incrementing or fixed outer ids (Antoine Tenart) [RHEL-123213]
+- net: gro: remove is_ipv6 from napi_gro_cb (Antoine Tenart) [RHEL-123213]
+- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161531]
+- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161531]
+- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-145154]
+- allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441]
+- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243}
+- iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546]
+- IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278]
+- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040}
+- Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936]
+- Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936]
+Resolves: RHEL-111893, RHEL-123213, RHEL-142546, RHEL-145154, RHEL-145936, RHEL-148654, RHEL-154278, RHEL-154397, RHEL-155441, RHEL-156881, RHEL-157473, RHEL-161531
+
 * Thu Mar 26 2026 Alexandra Hájková <ahajkova@redhat.com> [6.12.0-216.el10]
 - redhat/configs: add CONFIG_DEBUG_NET_SMALL_RTNL (Antoine Tenart) [RHEL-150155]
 - net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy (Antoine Tenart) [RHEL-150155]
@@ -1356,6 +1380,16 @@ Resolves: RHEL-138728, RHEL-151838, RHEL-152643, RHEL-153335
 - cache: sifive_ccache: Add ESWIN EIC7700 support (Jennifer Berringer) [RHEL-129062]
 Resolves: RHEL-129062, RHEL-135095, RHEL-145975, RHEL-150776, RHEL-97168
 
+* Fri Mar 27 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.6.1.el10_2]
+- allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441]
+- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243}
+- iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546]
+- IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278]
+- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040}
+- Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936]
+- Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936]
+Resolves: RHEL-142546, RHEL-145936, RHEL-148654, RHEL-154278, RHEL-155441, RHEL-156881
+
 * Tue Mar 24 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.5.1.el10_2]
 - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156}
 - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265]
diff --git a/kernel.spec b/kernel.spec
index 0a95b3664..e8bb16339 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -176,15 +176,15 @@ Summary: The Linux kernel
 %define specrpmversion 6.12.0
 %define specversion 6.12.0
 %define patchversion 6.12
-%define pkgrelease 216
+%define pkgrelease 217
 %define kversion 6
-%define tarfile_release 6.12.0-216.el10
+%define tarfile_release 6.12.0-217.el10
 # This is needed to do merge window version magic
 %define patchlevel 12
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 216%{?buildid}%{?dist}
+%define specrelease 217%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 6.12.0-216.el10
+%define kabiversion 6.12.0-217.el10
 
 # If this variable is set to 1, a bpf selftests build failure will cause a
 # fatal kernel package build error
@@ -797,6 +797,7 @@ BuildRequires: lld
 %endif
 BuildRequires: libcap-devel libcap-ng-devel rsync libmnl-devel libxml2-devel
 BuildRequires: numactl-devel
+BuildRequires: xxd
 %endif
 BuildConflicts: rhbuildsys(DiskFree) < 500Mb
 %if %{with_debuginfo}
@@ -1029,6 +1030,8 @@ Source103: rhelimaca1.x509
 Source104: rhelima.x509
 Source105: rhelima_centos.x509
 Source106: fedoraimaca.x509
+Source107: nvidiajetsonsoc.x509
+Source108: nvidiabfdpu.x509
 
 %if 0%{?fedora}%{?eln}
 %define ima_ca_cert %{SOURCE106}
@@ -2091,7 +2094,9 @@ truncate -s0 ../certs/rhel.pem
 openssl x509 -inform der -in %{SOURCE100} -out rheldup3.pem
 openssl x509 -inform der -in %{SOURCE101} -out rhelkpatch1.pem
 openssl x509 -inform der -in %{SOURCE102} -out nvidiagpuoot001.pem
-cat rheldup3.pem rhelkpatch1.pem nvidiagpuoot001.pem >> ../certs/rhel.pem
+openssl x509 -inform der -in %{SOURCE107} -out nvidiajetsonsoc.pem
+openssl x509 -inform der -in %{SOURCE108} -out nvidiabfdpu.pem
+cat rheldup3.pem rhelkpatch1.pem nvidiagpuoot001.pem nvidiajetsonsoc.pem nvidiabfdpu.pem >> ../certs/rhel.pem
 # rhelkeys
 %endif
 %if %{signkernel}
@@ -4483,6 +4488,29 @@ fi\
 #
 #
 %changelog
+* Mon Mar 30 2026 Alexandra Hájková <ahajkova@redhat.com> [6.12.0-217.el10]
+- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154397]
+- smb/client: remove unused SMB311_posix_query_info() (Paulo Alcantara) [RHEL-154397]
+- smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() (Paulo Alcantara) [RHEL-154397]
+- smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() (Paulo Alcantara) [RHEL-154397]
+- ACPI: AGDI: Add interrupt signaling mode support (Charles Mirabile) [RHEL-111893]
+- add xxd to as BuildRequire for bpf selftests (Ines Qian) [RHEL-157473]
+- selftests/net: test ipip packets in gro.sh (Antoine Tenart) [RHEL-123213]
+- net: gro: remove unnecessary df checks (Antoine Tenart) [RHEL-123213]
+- net: gso: restore ids of outer ip headers correctly (Antoine Tenart) [RHEL-123213]
+- net: gro: only merge packets with incrementing or fixed outer ids (Antoine Tenart) [RHEL-123213]
+- net: gro: remove is_ipv6 from napi_gro_cb (Antoine Tenart) [RHEL-123213]
+- s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161531]
+- s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161531]
+- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-145154]
+- allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441]
+- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243}
+- iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546]
+- IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278]
+- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040}
+- Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936]
+- Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936]
+
 * Thu Mar 26 2026 Alexandra Hájková <ahajkova@redhat.com> [6.12.0-216.el10]
 - redhat/configs: add CONFIG_DEBUG_NET_SMALL_RTNL (Antoine Tenart) [RHEL-150155]
 - net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy (Antoine Tenart) [RHEL-150155]
diff --git a/nvidiabfdpu.x509 b/nvidiabfdpu.x509
new file mode 100644
index 000000000..18b9b0058
Binary files /dev/null and b/nvidiabfdpu.x509 differ
diff --git a/nvidiajetsonsoc.x509 b/nvidiajetsonsoc.x509
new file mode 100644
index 000000000..0978d60dd
Binary files /dev/null and b/nvidiajetsonsoc.x509 differ
diff --git a/sources b/sources
index d0b1a72e2..2d4061e3a 100644
--- a/sources
+++ b/sources
@@ -1,5 +1,5 @@
 SHA512 (kernel-abi-stablelists-6.6.0.tar.bz2) = 4f917598056dee5e23814621ec96ff2e4a411c8c4ba9d56ecb01b23cb96431825bedbecfcbaac9338efbf5cb21694d85497fa0bf43e7c80d9cd10bc6dd144dbd
 SHA512 (kernel-kabi-dw-6.6.0.tar.bz2) = 19308cd976031d05e18ef7f5d093218acdb89446418bab0cd956ff12cf66369915b9e64bb66fa9f20939428a60e81884fec5be3529c6c7461738d6540d3cc5c6
-SHA512 (linux-6.12.0-216.el10.tar.xz) = 6b51512f1d8b8aa2a0776d489b4399c871bd48adf862e5180c005ba6d7ad65a3b80c898e92616f81d067770584427c7e53cf670a32b509f6fca746763afa5ca6
-SHA512 (kernel-abi-stablelists-6.12.0-216.el10.tar.xz) = 456a8e02ff6086157a538557ff4c762790102b48d08176d009b8bb4505b771e5faa89b51308030c8a0f2df5a955fa20c636450c3cef5483024920f56e9a25be1
-SHA512 (kernel-kabi-dw-6.12.0-216.el10.tar.xz) = e81b8cd9f08c77147d95b281f43f38af27f378a2fcb7811923244a50ffc9ca3286f9f5ae496f6448152d45d37afb66e56a542a2ea5ca93c624bcb2c02ac1d619
+SHA512 (linux-6.12.0-217.el10.tar.xz) = 1972a8551b5e9f339c6c2db83ea2706de6459fe0ef1134c241caa6c2ddb5ac20d203452d9b0a7b48b691019f0546fb6db247ffcd7b2dea59df9cf22fc6f4eef7
+SHA512 (kernel-abi-stablelists-6.12.0-217.el10.tar.xz) = fd04f0a1b5252aee9b4c4f7fbe31ac785340bf939c8c2c91214738b7bdba03f10b0a2c2ccf943cf623eeadc5984de173128a904549460a8ddfe4b23321dd0a3a
+SHA512 (kernel-kabi-dw-6.12.0-217.el10.tar.xz) = e81b8cd9f08c77147d95b281f43f38af27f378a2fcb7811923244a50ffc9ca3286f9f5ae496f6448152d45d37afb66e56a542a2ea5ca93c624bcb2c02ac1d619