diff --git a/Makefile.rhelver b/Makefile.rhelver
index c103b0091..2e6dc0a68 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 8
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 650
+RHEL_RELEASE = 651
 
 #
 # ZSTREAM
diff --git a/kernel.changelog b/kernel.changelog
index 7d075ed98..950e50f23 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,11 @@
+* Fri Dec 12 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-651.el9]
+- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CKI Backport Bot) [RHEL-129257] {CVE-2025-38499}
+- redhat: conflict with unsupported shim on x86/aarch64 (Vitaly Kuznetsov) [RHEL-126425]
+- mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125520] {CVE-2025-39843}
+- slub: Reflow ___slab_alloc() (Audra Mitchell) [RHEL-125520] {CVE-2025-39843}
+- KVM: s390: improve interrupt cpu for wakeup (CKI Backport Bot) [RHEL-121783]
+Resolves: RHEL-121783, RHEL-125520, RHEL-126425, RHEL-129257
+
 * Thu Dec 11 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-650.el9]
 - x86/amd_node: Fix AMD root device caching (David Arcari) [RHEL-127821]
 - x86/amd_node: Add support for debugfs access to SMN registers (David Arcari) [RHEL-127821]
diff --git a/kernel.spec b/kernel.spec
index d276cb755..9c343cbcb 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -165,15 +165,15 @@ Summary: The Linux kernel
 # define buildid .local
 %define specversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 650
+%define pkgrelease 651
 %define kversion 5
-%define tarfile_release 5.14.0-650.el9
+%define tarfile_release 5.14.0-651.el9
 # This is needed to do merge window version magic
 %define patchlevel 14
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 650%{?buildid}%{?dist}
+%define specrelease 651%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 5.14.0-650.el9
+%define kabiversion 5.14.0-651.el9
 
 #
 # End of genspec.sh variables
@@ -975,6 +975,9 @@ Recommends: linux-firmware\
 Requires(preun): systemd >= 200\
 Conflicts: xfsprogs < 4.3.0-1\
 Conflicts: xorg-x11-drv-vmmouse < 13.0.99\
+%ifarch x86_64 aarch64\
+Conflicts: shim < 15.8-1\
+%endif\
 %{expand:%%{?kernel%{?1:_%{1}}_conflicts:Conflicts: %%{kernel%{?1:_%{1}}_conflicts}}}\
 %{expand:%%{?kernel%{?1:_%{1}}_obsoletes:Obsoletes: %%{kernel%{?1:_%{1}}_obsoletes}}}\
 %{expand:%%{?kernel%{?1:_%{1}}_provides:Provides: %%{kernel%{?1:_%{1}}_provides}}}\
@@ -3694,6 +3697,13 @@ fi
 #
 #
 %changelog
+* Fri Dec 12 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-651.el9]
+- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CKI Backport Bot) [RHEL-129257] {CVE-2025-38499}
+- redhat: conflict with unsupported shim on x86/aarch64 (Vitaly Kuznetsov) [RHEL-126425]
+- mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125520] {CVE-2025-39843}
+- slub: Reflow ___slab_alloc() (Audra Mitchell) [RHEL-125520] {CVE-2025-39843}
+- KVM: s390: improve interrupt cpu for wakeup (CKI Backport Bot) [RHEL-121783]
+
 * Thu Dec 11 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-650.el9]
 - x86/amd_node: Fix AMD root device caching (David Arcari) [RHEL-127821]
 - x86/amd_node: Add support for debugfs access to SMN registers (David Arcari) [RHEL-127821]
diff --git a/sources b/sources
index fed263619..a3a15ca26 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-5.14.0-650.el9.tar.xz) = 275d50c66096b6aa767d2f4a06d748605339c4ced999c39373b8f1005573b39cb7d2e11c4ecab99f8a21ae19ffc3b4037362489e04b790b6f57176c4edfdc072
-SHA512 (kernel-abi-stablelists-5.14.0-650.el9.tar.bz2) = 1991c96aed33c643f5de74c744a0dc0443bb25e7b3c167b258795d82479201148a450050a2b35f3e902b63e0ae8b6592a25f9d5680ffaadc89aa4c335208660c
-SHA512 (kernel-kabi-dw-5.14.0-650.el9.tar.bz2) = 6ce93d7522a957f9370e8f1d03510b2cb2162e2bb02d7067bc1e000beb1b9f991b75503cb421a3e8c16cfdcd5e845356b02d6ad60ea2049bda6e0811fc9c55a0
+SHA512 (linux-5.14.0-651.el9.tar.xz) = d612756cfde3164d79673f9afcbb5bb366fe5678c84f186c9010784f08e17d86d32642ffced5329c52f188c877bae8b822574b3447a7f4cb0f12a39c44b3801d
+SHA512 (kernel-abi-stablelists-5.14.0-651.el9.tar.bz2) = af5939179ea6188f3269754bd01388d0fc9d4864ff15ecaf3bf7d2530f5b843515cad13013f7a6adae8442c9616d4153d5b7e770c1ca39165c982f06c562c4f4
+SHA512 (kernel-kabi-dw-5.14.0-651.el9.tar.bz2) = 077d07895b5f0172606a63433e3313fad6ee3b2859d5171138959c8a5767bdac0e8c91a4de76e03909ba27d2e61dafd5704b938992956acd3c587ed2dff204c6