diff --git a/kernel-aarch64-debug.config b/kernel-aarch64-debug.config
index 474579a46..8c282447f 100644
--- a/kernel-aarch64-debug.config
+++ b/kernel-aarch64-debug.config
@@ -3230,6 +3230,7 @@ CONFIG_EEPROM_MAX6875=m
 CONFIG_EFI=y
 CONFIG_EFIVAR_FS=y
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_EFI_STUB=y
 CONFIG_EFI_VARS=y
 CONFIG_EFI_VARS_PSTORE=y
diff --git a/kernel-aarch64.config b/kernel-aarch64.config
index f78f6e532..e5c1ae953 100644
--- a/kernel-aarch64.config
+++ b/kernel-aarch64.config
@@ -3259,6 +3259,7 @@ CONFIG_EEPROM_MAX6875=m
 CONFIG_EFI=y
 CONFIG_EFIVAR_FS=y
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_EFI_STUB=y
 CONFIG_EFI_VARS=y
 CONFIG_EFI_VARS_PSTORE=y
diff --git a/kernel-ppc64le-debug.config b/kernel-ppc64le-debug.config
index 312c6220c..0391262b5 100644
--- a/kernel-ppc64le-debug.config
+++ b/kernel-ppc64le-debug.config
@@ -2900,6 +2900,7 @@ CONFIG_EEPROM_AT24=m
 CONFIG_EEPROM_LEGACY=m
 CONFIG_EEPROM_MAX6875=m
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_ENCLOSURE_SERVICES=m
 CONFIG_ENCRYPTED_KEYS=y
diff --git a/kernel-ppc64le.config b/kernel-ppc64le.config
index ee6239bb1..a4cd73590 100644
--- a/kernel-ppc64le.config
+++ b/kernel-ppc64le.config
@@ -2926,6 +2926,7 @@ CONFIG_EEPROM_AT24=m
 CONFIG_EEPROM_LEGACY=m
 CONFIG_EEPROM_MAX6875=m
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_ENCLOSURE_SERVICES=m
 CONFIG_ENCRYPTED_KEYS=y
diff --git a/kernel-s390x-debug.config b/kernel-s390x-debug.config
index d3f72d6f2..974b73d85 100644
--- a/kernel-s390x-debug.config
+++ b/kernel-s390x-debug.config
@@ -3006,6 +3006,7 @@ CONFIG_EDAC_GHES=y
 CONFIG_EDAC_LEGACY_SYSFS=y
 CONFIG_EDAC_PND2=m
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_ENCLOSURE_SERVICES=m
 CONFIG_ENCRYPTED_KEYS=m
diff --git a/kernel-s390x-zfcpdump.config b/kernel-s390x-zfcpdump.config
index 9135e31f9..c74f8e96c 100644
--- a/kernel-s390x-zfcpdump.config
+++ b/kernel-s390x-zfcpdump.config
@@ -3175,6 +3175,7 @@ CONFIG_EDAC_GHES=y
 CONFIG_EDAC_LEGACY_SYSFS=y
 CONFIG_EDAC_PND2=m
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_ELF_CORE=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_ENCLOSURE_SERVICES=y
diff --git a/kernel-s390x.config b/kernel-s390x.config
index 8f8e46fed..16301d600 100644
--- a/kernel-s390x.config
+++ b/kernel-s390x.config
@@ -3034,6 +3034,7 @@ CONFIG_EDAC_GHES=y
 CONFIG_EDAC_LEGACY_SYSFS=y
 CONFIG_EDAC_PND2=m
 CONFIG_EFI_PARTITION=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_ENCLOSURE_SERVICES=m
 CONFIG_ENCRYPTED_KEYS=m
diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config
index 213c7e212..330be0e5c 100644
--- a/kernel-x86_64-debug.config
+++ b/kernel-x86_64-debug.config
@@ -3012,6 +3012,7 @@ CONFIG_EFI_MIXED=y
 CONFIG_EFI_PARTITION=y
 CONFIG_EFI_RCI2_TABLE=y
 CONFIG_EFI_RUNTIME_MAP=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_EFI_STUB=y
 CONFIG_EFI_VARS=y
 CONFIG_EFI_VARS_PSTORE=y
diff --git a/kernel-x86_64.config b/kernel-x86_64.config
index 805cd4e29..f0d3b0c18 100644
--- a/kernel-x86_64.config
+++ b/kernel-x86_64.config
@@ -3040,6 +3040,7 @@ CONFIG_EFI_MIXED=y
 CONFIG_EFI_PARTITION=y
 CONFIG_EFI_RCI2_TABLE=y
 CONFIG_EFI_RUNTIME_MAP=y
+CONFIG_EFI_SBAT_FILE=""
 CONFIG_EFI_STUB=y
 CONFIG_EFI_VARS=y
 CONFIG_EFI_VARS_PSTORE=y
diff --git a/kernel.sbat.template b/kernel.sbat.template
new file mode 100644
index 000000000..11f92833b
--- /dev/null
+++ b/kernel.sbat.template
@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+kernel.@SBAT_SUFFIX,1,Red Hat,kernel-core,@KVER,mailto:secalert@redhat.com
diff --git a/kernel.spec b/kernel.spec
index 53ff208a9..6cbb5ae40 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -21,6 +21,17 @@
 %global signkernel 0
 %endif
 
+# RHEL/CentOS/Fedora specific .SBAT entries
+%if 0%{?centos}
+%global sbat_suffix centos
+%else
+%if 0%{?fedora}
+%global sbat_suffix fedora
+%else
+%global sbat_suffix rhel
+%endif
+%endif
+
 # Sign modules on all arches
 %global signmodules 1
 
@@ -38,10 +49,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.137.1.el8_10
+%define pkgrelease 553.138.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.137.1%{?dist}
+%define specrelease 553.138.1%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -483,6 +494,7 @@ Source17: mod-blacklist.sh
 Source18: mod-sign.sh
 Source19: mod-extra.list
 Source80: parallel_xz.sh
+Source85: kernel.sbat.template
 Source90: filter-x86_64.sh
 Source93: filter-aarch64.sh
 Source96: filter-ppc64le.sh
@@ -1142,6 +1154,9 @@ pathfix.py -i %{__python3} -p -n \
 
 %define make make %{?cross_opts} HOSTCFLAGS="%{?build_hostcflags}" HOSTLDFLAGS="%{?build_hostldflags}"
 
+# SBAT data
+sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE85} > kernel.sbat
+
 # only deal with configs if we are going to build for the arch
 %ifnarch %nobuildarches
 
@@ -1184,6 +1199,7 @@ cat secureboot.pem >> ../certs/rhel.pem
 %endif
 for i in *.config; do
   sed -i 's@CONFIG_SYSTEM_TRUSTED_KEYS=""@CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"@' $i
+  sed -i 's@CONFIG_EFI_SBAT_FILE=""@CONFIG_EFI_SBAT_FILE="kernel.sbat"@' $i
 done
 %endif
 %endif
@@ -2707,6 +2723,18 @@ fi
 #
 #
 %changelog
+* Wed Jun 24 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.138.1.el8_10]
+- redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788]
+- redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788]
+- redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788]
+- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788]
+- x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788]
+- redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788]
+- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984}
+- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984}
+- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189}
+- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216}
+
 * Fri Jun 19 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.137.1.el8_10]
 - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054}
 - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054}
diff --git a/sources b/sources
index d99c9c194..8040cebc6 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-553.137.1.el8_10.tar.xz) = ae799a53ff4ac61f7d60b8d1179d374633b68e96fc586b8e16d31bf04173a1e4a1a5d7ca5a15803b3acedd2e2bf3b10199eb8e454e45693809b6ad92a8c150b6
-SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 99f7865971896809ce6a108704951abf2a418ed101dc5076d00ae417e903ea7f4147a946c5bb739fbc32361244298991a621e899e05274657308be31c62486f2
-SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = 978f6aa61e64062558187d22ba736d3445e48d7b22b0ff7287c610480a7f0786dffcbece7b7ba7abfc5eb4ef7286f7edf708085be53977cd5bea474aa5a46296
+SHA512 (linux-4.18.0-553.138.1.el8_10.tar.xz) = a03a12d29920e3f34d3c01d865ed5eb85c1155ae7304f2718fed483e0be2ffe51390f315d55ed27e262d5c6e170a1ca193ab144a6eda8400d177d287633fa389
+SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 26cf69094f969002a4486ea4929418b142efbb5991512f293f40b4e83caf858a565ff1be9bae3d2a74134005caae59bf5260f76bcb32f6be2672f55882914363
+SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = 4d640c3c4ead499b725b49a9cade44926ec213e86dbf9268f0a151bbe084e0ea9bf0a97b583adf85579427d233e74695e5b15a806bcadb07d2669a06a2493d65