diff --git a/Makefile.rhelver b/Makefile.rhelver
index 5523ea889..3eb368978 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 8
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 662
+RHEL_RELEASE = 663
 
 #
 # ZSTREAM
diff --git a/kernel.changelog b/kernel.changelog
index 87f93c196..ca4eaad17 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,18 @@
+* Tue Jan 20 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-663.el9]
+- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek) [RHEL-58952]
+- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140261] {CVE-2025-68349}
+- smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131389] {CVE-2025-39933}
+- redhat/kernel.spec.template: Let kernel-modules installation rebuild initrd in UKI system (Li Tian) [RHEL-135721]
+- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129113] {CVE-2025-40154}
+- xfrm: bring back device check in validate_xmit_xfrm (Hangbin Liu) [RHEL-116770]
+- bonding: Fix multiple long standing offload races (Hangbin Liu) [RHEL-116770]
+- bonding: Mark active offloaded xfrm_states (Hangbin Liu) [RHEL-116770]
+- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Hangbin Liu) [RHEL-116770]
+- xfrm: Remove unneeded device check from validate_xmit_xfrm (Hangbin Liu) [RHEL-116770]
+- xfrm: Use xdo.dev instead of xdo.real_dev (Hangbin Liu) [RHEL-116770]
+- net/mlx5: Avoid using xso.real_dev unnecessarily (Hangbin Liu) [RHEL-116770]
+Resolves: RHEL-116770, RHEL-129113, RHEL-131389, RHEL-135721, RHEL-140261, RHEL-58952
+
 * Sat Jan 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-662.el9]
 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139463] {CVE-2025-68305}
 - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 (Guillaume Nault) [RHEL-138491]
diff --git a/kernel.spec b/kernel.spec
index 7ec1ba724..03737064f 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -176,15 +176,15 @@ Summary: The Linux kernel
 # define buildid .local
 %define specversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 662
+%define pkgrelease 663
 %define kversion 5
-%define tarfile_release 5.14.0-662.el9
+%define tarfile_release 5.14.0-663.el9
 # This is needed to do merge window version magic
 %define patchlevel 14
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 662%{?buildid}%{?dist}
+%define specrelease 663%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 5.14.0-662.el9
+%define kabiversion 5.14.0-663.el9
 
 #
 # End of genspec.sh variables
@@ -3234,7 +3234,9 @@ fi\
 %define kernel_modules_post() \
 %{expand:%%post %{?1:%{1}-}modules}\
 /sbin/depmod -a %{KVERREL}%{?1:+%{1}}\
-if [ ! -f %{_localstatedir}/lib/rpm-state/%{name}/installing_core_%{KVERREL}%{?1:+%{1}} ]; then\
+if [ -f /lib/modules/%{KVERREL}%{?1:+%{1}}/vmlinuz ] &&\
+[ -f /boot/initramfs-%{KVERREL}%{?1:+%{1}}.img ] &&\
+[ ! -f %{_localstatedir}/lib/rpm-state/%{name}/installing_core_%{KVERREL}%{?1:+%{1}} ]; then\
 	mkdir -p %{_localstatedir}/lib/rpm-state/%{name}\
 	touch %{_localstatedir}/lib/rpm-state/%{name}/need_to_run_dracut_%{KVERREL}%{?1:+%{1}}\
 fi\
@@ -3245,8 +3247,8 @@ fi\
 %{expand:%%posttrans %{?1:%{1}-}modules}\
 if [ -f %{_localstatedir}/lib/rpm-state/%{name}/need_to_run_dracut_%{KVERREL}%{?1:+%{1}} ]; then\
 	rm -f %{_localstatedir}/lib/rpm-state/%{name}/need_to_run_dracut_%{KVERREL}%{?1:+%{1}}\
-	echo "Running: dracut -f --kver %{KVERREL}%{?1:+%{1}}"\
-	dracut -f --kver "%{KVERREL}%{?1:+%{1}}" || exit $?\
+	echo "Running: dracut -f --kver %{KVERREL}%{?1:+%{1}} /boot/initramfs-%{KVERREL}%{?1:+%{1}}.img"\
+	dracut -f --kver "%{KVERREL}%{?1:+%{1}}" /boot/initramfs-%{KVERREL}%{?1:+%{1}}.img || exit $?\
 fi\
 %{nil}
 
@@ -3703,6 +3705,20 @@ fi
 #
 #
 %changelog
+* Tue Jan 20 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-663.el9]
+- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek) [RHEL-58952]
+- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140261] {CVE-2025-68349}
+- smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131389] {CVE-2025-39933}
+- redhat/kernel.spec.template: Let kernel-modules installation rebuild initrd in UKI system (Li Tian) [RHEL-135721]
+- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129113] {CVE-2025-40154}
+- xfrm: bring back device check in validate_xmit_xfrm (Hangbin Liu) [RHEL-116770]
+- bonding: Fix multiple long standing offload races (Hangbin Liu) [RHEL-116770]
+- bonding: Mark active offloaded xfrm_states (Hangbin Liu) [RHEL-116770]
+- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Hangbin Liu) [RHEL-116770]
+- xfrm: Remove unneeded device check from validate_xmit_xfrm (Hangbin Liu) [RHEL-116770]
+- xfrm: Use xdo.dev instead of xdo.real_dev (Hangbin Liu) [RHEL-116770]
+- net/mlx5: Avoid using xso.real_dev unnecessarily (Hangbin Liu) [RHEL-116770]
+
 * Sat Jan 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-662.el9]
 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139463] {CVE-2025-68305}
 - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 (Guillaume Nault) [RHEL-138491]
diff --git a/sources b/sources
index 95708d69d..5db5c969a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-5.14.0-662.el9.tar.xz) = 1a2f3b0a5c7106fffa95aa41d4c6b29c08d5233f8ced7b9186a8cb12bfcae4b3c01438141adde67abb4e207717af8b1ea5b6bc76076f9383b268b1452d6165be
-SHA512 (kernel-abi-stablelists-5.14.0-662.el9.tar.bz2) = fe16354dfaa142b4fab1f60f5ac88ec9cca59c74587afa75efa37d45b9e09173612602a9722e8ea42529289974158c152a971894c8e591bb624496ebfefd0460
-SHA512 (kernel-kabi-dw-5.14.0-662.el9.tar.bz2) = cfafe4c843da394ee69775314e986be576b2267941b0b8a3dc6c0690fbd80c219d3b35e69c2ea6088c5d13cf9ff162069e56b11fddf838333db935a22aab5197
+SHA512 (linux-5.14.0-663.el9.tar.xz) = e0607f04df1637d23f4f4ebf62afee1ba2e3bf9de6205aea36596e909b7f03cc6487eabfb2b57bc706e97a581f295d151ee295fdd3baf3c6fb049f95a774922d
+SHA512 (kernel-abi-stablelists-5.14.0-663.el9.tar.bz2) = c6b3375cdac4cb5d50621599ab2de910691f46235d6d5f7734d86339d6c44c025cfdd8682d0b8823f8e84e08575b107f7799b7620a9aae81e65d8003392043b4
+SHA512 (kernel-kabi-dw-5.14.0-663.el9.tar.bz2) = aeae34dbf19064a7a21c4003fdaa2064b9c3bbab6e188bb82078347982a7d6cfc1e4f5c5b02d3d537c9e7d6b521a14f3a10395e28e54783a64d391905ea4589a