diff --git a/kernel.spec b/kernel.spec
index 180813789..4c9c853bf 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.127.1.el8_10
+%define pkgrelease 553.128.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.127.1%{?dist}
+%define specrelease 553.128.1%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -2707,6 +2707,12 @@ fi
 #
 #
 %changelog
+* Fri May 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.128.1.el8_10]
+- smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613}
+- geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961]
+- geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858}
+- netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392}
+
 * Wed May 27 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.127.1.el8_10]
 - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781}
 - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366}
diff --git a/sources b/sources
index 161b63f56..3c21fe362 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-553.127.1.el8_10.tar.xz) = 4649cb0f15d883ff84a8911b8798883672a20e8ab5bf52c2fdb9daa2b9109dcf2d870a2f7cf4812eb4af30849f498118dbcf9813860d596c3ec25b8a605c0d57
-SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 64b750a5cd23b319c9e857e0b3e7bcfc04b166fe201d290d3e91a5553f25befe453031c2612108d5786d916fa03155407ba51402b22fb1f9d89a075eff608170
-SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = d5e7cd452bb0de339bbda6fa611f6e79291ec70a64e86bf7fe62cc27b69512d9c23425531fd54d3fd34105e0a9d4b0a12ee4b57af70c449edf5101212dd67486
+SHA512 (linux-4.18.0-553.128.1.el8_10.tar.xz) = a7af001e757ca275383f229d854361387b57388124c7aeb26e941d6eed560e6b5ac3e9ec0fe9555ac93ddb0f489b1d9b121f89a7e7412a7fdb0ba08c4783baa4
+SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = a39b801a483f2387fcdd1a9a65019f5b29485b2a81e6bb8ed11768e0cd8c4a3cc331681de8b14615bdf0e9074f3f340c50abc70115b7113445be2215a53f55c9
+SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = d8a36d848038d3fcd6a3e40a5b2354850bf12797060090ad49f4ed773eab717b22ceb42961278b563f7165b629400430cda7067eb96c4ca4f6e1f68d0757d997