diff --git a/kernel.spec b/kernel.spec
index edbe82bb3..c8b1df8aa 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -12,7 +12,7 @@
 # change below to w4T.xzdio):
 %define _binary_payload w3T.xzdio
 
-%global distro_build 537
+%global distro_build 538
 
 # Sign the x86_64 kernel for secure boot authentication
 %ifarch x86_64 aarch64 s390x ppc64le
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 537.el8
+%define pkgrelease 538.el8
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 537%{?dist}
+%define specrelease 538%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -2695,6 +2695,27 @@ fi
 #
 #
 %changelog
+* Wed Jan 31 2024 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-538.el8]
+- ida: Fix crash in ida_free when the bitmap is empty (Wander Lairson Costa) [RHEL-19681] {CVE-2023-6915}
+- mm: create a new system state and fix core_kernel_text() (Joel Savitz) [RHEL-5227]
+- redhat: rewrite genlog and support Y- tags (Jan Stancek)
+- Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" (Nigel Croxon) [RHEL-22698]
+- Revert "x86/fpu/xstate: Fix PKRU covert channel" (Steve Best) [RHEL-22192]
+- net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-19065] {CVE-2024-0646}
+- smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-18990] {CVE-2023-6606}
+- smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-19144] {CVE-2023-6610}
+- smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-19144] {CVE-2023-6610}
+- ovl: skip stale entries in merge dir cache iteration (Miklos Szeredi) [RHEL-18076]
+- ovl: invalidate readdir cache on changes to dir with origin (Miklos Szeredi) [RHEL-18076]
+- ipv6: avoid atomic fragment on GSO packets (Hangbin Liu) [RHEL-22149]
+- ipv6: fix potential NULL deref in fib6_add() (Hangbin Liu) [RHEL-22149]
+- lockdep: Fix block chain corruption (Joel Savitz) [RHEL-5227]
+- futex: Don't include process MM in futex key on no-MMU (Joel Savitz) [RHEL-5227]
+- locking/rtmutex: Fix task->pi_waiters integrity (Joel Savitz) [RHEL-5227]
+- locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers (Joel Savitz) [RHEL-5227]
+- locking/rwsem: Disable preemption in all down_write*() and up_write() code paths (Joel Savitz) [RHEL-5227]
+- mm: make generic arch_is_kernel_initmem_freed() do what it says (Joel Savitz) [RHEL-5227]
+
 * Wed Jan 24 2024 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-537.el8]
 - cgroup/cpuset: Inherit parent's load balance state in v2 (Waiman Long) [RHEL-12873]
 - cgroup/cpuset: Free DL BW in case can_attach() fails (Waiman Long) [RHEL-12873]
diff --git a/sources b/sources
index 381ed1b1c..a79594f91 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-537.el8.tar.xz) = 164b02050fcd24f05c9ade73799ec924c45b1907f6c0abd6258cf0c815f2b089d13dc228c65d75f48467fbf3400067b54dac97e8fb2b094f66faa867f7ebc227
-SHA512 (kernel-abi-stablelists-4.18.0-537.tar.bz2) = f9cfc23bd68e39c675f2a090174a40170aaec71ed8fed4559e11a8d79b00a80f3f9767925b414e8761c4695b110c2a39276fa29d21fb57b9c67b60267afc08e8
-SHA512 (kernel-kabi-dw-4.18.0-537.tar.bz2) = a8b00c7ae3653dc7305ad2a7c14ebbdad9c0b90248b7c2e4b4f31f2a23a11dfe7a1931f8e676a7dcb11b06ff87a21838ae4ccf837549b73ff76bff397e758a9f
+SHA512 (linux-4.18.0-538.el8.tar.xz) = 8c6841d54fbb3722ebc4a3afe7a769508fc6f3d6dd967d0ac3423846ee2f32caf72aad709d50ec16728013b996bfbceab4ebff24b66dcdee14d664cd0ce1b6d3
+SHA512 (kernel-abi-stablelists-4.18.0-538.tar.bz2) = dcbafec6a22e9c5491dfa4dc3b6411cedbe975ea74f0e8923b6debad6cadb6b0b9a1f3fd7fb992c4fdcf9d3e5a64cb433ffc69a3e49701452922352e4d817572
+SHA512 (kernel-kabi-dw-4.18.0-538.tar.bz2) = 8a671ed3c9b7f4b25fd4e594b62bc4a26474cb705d3ed22ca376618b3c7962fc72ace1ffd02c9c3a192d9d2c449d38228809542d7f16ebad16f8127020eb2faf