diff --git a/Makefile.rhelver b/Makefile.rhelver
index 12bc6d3dd..4d69aa9bf 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 9
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 737
+RHEL_RELEASE = 738
 
 #
 # ZSTREAM
diff --git a/kernel-aarch64-64k-debug-rhel.config b/kernel-aarch64-64k-debug-rhel.config
index 5e321cfa5..c447c9744 100644
--- a/kernel-aarch64-64k-debug-rhel.config
+++ b/kernel-aarch64-64k-debug-rhel.config
@@ -6536,6 +6536,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-64k-rhel.config b/kernel-aarch64-64k-rhel.config
index 981e5db01..8f0bee964 100644
--- a/kernel-aarch64-64k-rhel.config
+++ b/kernel-aarch64-64k-rhel.config
@@ -6511,6 +6511,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-debug-rhel.config b/kernel-aarch64-debug-rhel.config
index 518c1a3fb..3c950fcb2 100644
--- a/kernel-aarch64-debug-rhel.config
+++ b/kernel-aarch64-debug-rhel.config
@@ -6534,6 +6534,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-rhel.config b/kernel-aarch64-rhel.config
index 88348c8c7..52e7fa552 100644
--- a/kernel-aarch64-rhel.config
+++ b/kernel-aarch64-rhel.config
@@ -6509,6 +6509,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-rt-64k-debug-rhel.config b/kernel-aarch64-rt-64k-debug-rhel.config
index 959734526..cc50e710c 100644
--- a/kernel-aarch64-rt-64k-debug-rhel.config
+++ b/kernel-aarch64-rt-64k-debug-rhel.config
@@ -6639,6 +6639,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-rt-64k-rhel.config b/kernel-aarch64-rt-64k-rhel.config
index d17742c3e..069ac585a 100644
--- a/kernel-aarch64-rt-64k-rhel.config
+++ b/kernel-aarch64-rt-64k-rhel.config
@@ -6614,6 +6614,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-rt-debug-rhel.config b/kernel-aarch64-rt-debug-rhel.config
index ebfc98079..f6db99089 100644
--- a/kernel-aarch64-rt-debug-rhel.config
+++ b/kernel-aarch64-rt-debug-rhel.config
@@ -6637,6 +6637,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-aarch64-rt-rhel.config b/kernel-aarch64-rt-rhel.config
index 47c7bac56..5dcdbc5aa 100644
--- a/kernel-aarch64-rt-rhel.config
+++ b/kernel-aarch64-rt-rhel.config
@@ -6612,6 +6612,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-ppc64le-debug-rhel.config b/kernel-ppc64le-debug-rhel.config
index 1af7784b3..7fcde99e1 100644
--- a/kernel-ppc64le-debug-rhel.config
+++ b/kernel-ppc64le-debug-rhel.config
@@ -5977,6 +5977,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-ppc64le-rhel.config b/kernel-ppc64le-rhel.config
index ce23ddb96..57bc6349e 100644
--- a/kernel-ppc64le-rhel.config
+++ b/kernel-ppc64le-rhel.config
@@ -5954,6 +5954,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-s390x-debug-rhel.config b/kernel-s390x-debug-rhel.config
index c3a804e20..647e59016 100644
--- a/kernel-s390x-debug-rhel.config
+++ b/kernel-s390x-debug-rhel.config
@@ -5966,6 +5966,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-s390x-rhel.config b/kernel-s390x-rhel.config
index 3eb3a8157..8384e32b6 100644
--- a/kernel-s390x-rhel.config
+++ b/kernel-s390x-rhel.config
@@ -5943,6 +5943,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-s390x-zfcpdump-rhel.config b/kernel-s390x-zfcpdump-rhel.config
index 61e36b330..3c2fe07b4 100644
--- a/kernel-s390x-zfcpdump-rhel.config
+++ b/kernel-s390x-zfcpdump-rhel.config
@@ -5967,6 +5967,7 @@ CONFIG_TCM_IBLOCK=y
 CONFIG_TCM_PSCSI=y
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-x86_64-debug-rhel.config b/kernel-x86_64-debug-rhel.config
index dd5b59b83..b7f83aac3 100644
--- a/kernel-x86_64-debug-rhel.config
+++ b/kernel-x86_64-debug-rhel.config
@@ -6303,6 +6303,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-x86_64-rhel.config b/kernel-x86_64-rhel.config
index d0d76ae19..b24c28451 100644
--- a/kernel-x86_64-rhel.config
+++ b/kernel-x86_64-rhel.config
@@ -6279,6 +6279,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-x86_64-rt-debug-rhel.config b/kernel-x86_64-rt-debug-rhel.config
index bc9107837..75868eeec 100644
--- a/kernel-x86_64-rt-debug-rhel.config
+++ b/kernel-x86_64-rt-debug-rhel.config
@@ -6404,6 +6404,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel-x86_64-rt-rhel.config b/kernel-x86_64-rt-rhel.config
index ac4da972b..7b4cafcd1 100644
--- a/kernel-x86_64-rt-rhel.config
+++ b/kernel-x86_64-rt-rhel.config
@@ -6380,6 +6380,7 @@ CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_PSCSI=m
 # CONFIG_TCM_QLA2XXX is not set
 CONFIG_TCM_USER2=m
+CONFIG_TCP_AO=y
 CONFIG_TCP_CONG_ADVANCED=y
 CONFIG_TCP_CONG_BBR=m
 CONFIG_TCP_CONG_BIC=m
diff --git a/kernel.changelog b/kernel.changelog
index e0a08f0de..30f733e05 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,213 @@
+* Mon Aug 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-738.el9]
+- scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339]
+- scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339]
+- scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl (Don Brace) [RHEL-224339]
+- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (Don Brace) [RHEL-224339]
+- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886}
+- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886}
+- platform/x86/intel/tpmi/plr: Prevent fault during unbind (Dennis Chen) [RHEL-212707]
+- platform/x86: intel: Add notifiers support (Dennis Chen) [RHEL-212707]
+- x86/fpu: Ensure XFD state on signal delivery (Dennis Chen) [RHEL-212652]
+- platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (Dennis Chen) [RHEL-212719]
+- ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Jaroslav Kysela) [RHEL-193254]
+- ASoC: amd: ps: disable MSI on resume in ACP PCI driver (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/tas2781: Cancel async firmware request at unbind (Jaroslav Kysela) [RHEL-193254]
+- firmware_loader: Add cancel helper for async requests (Jaroslav Kysela) [RHEL-193254]
+- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (Jaroslav Kysela) [RHEL-193254]
+- ALSA: scarlett2: Allow selecting config_set by firmware version (Jaroslav Kysela) [RHEL-193254]
+- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: topology: fix memory leak in snd_sof_load_topology (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: topology: validate vendor array size before parsing (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc4-control: Validate notification payload size (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (Jaroslav Kysela) [RHEL-193254]
+- ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 (Jaroslav Kysela) [RHEL-193254]
+- ALSA: FCP: Fix NULL pointer dereference in interface lookup (Jaroslav Kysela) [RHEL-193254]
+- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SDCA: Validate written enum value in ge_put_enum_double() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: clear opened when stream enable fails (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: reject stream disable with no active interface (Jaroslav Kysela) [RHEL-193254]
+- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: Free sideband sg_table objects (Jaroslav Kysela) [RHEL-193254]
+- soundwire: intel_ace2x: release bpt_stream when close it (Jaroslav Kysela) [RHEL-193254]
+- soundwire: fix bug in sdw_add_element_group_count found by syzkaller (Jaroslav Kysela) [RHEL-193254]
+- soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral (Jaroslav Kysela) [RHEL-193254]
+- mfd: cs42l43: Sanity check firmware size (Jaroslav Kysela) [RHEL-193254]
+- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: avoid stale FIFO cells during resize (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: oss: Serialize readq reset state with q->lock (Jaroslav Kysela) [RHEL-193254]
+- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: Guard sideband endpoint removal (Jaroslav Kysela) [RHEL-193254]
+- ASoC: topology: Check PCM and DAI name strings before use (Jaroslav Kysela) [RHEL-193254]
+- ASoC: tegra: tegra210_ahub: Validate written enum value (Jaroslav Kysela) [RHEL-193254]
+- ASoC: fsl: fsl_audmix: Validate written enum values (Jaroslav Kysela) [RHEL-193254]
+- ASoC: meson: aiu: Validate written enum values (Jaroslav Kysela) [RHEL-193254]
+- ASoC: codecs: hdac_hdmi: Validate written enum value (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from SND_SOC_SOF_HDA_GENERIC=y (Jaroslav Kysela) [RHEL-193254]
+- ASoC: cs35l56: Fix wrong error test on simple_write_to_buffer() (Jaroslav Kysela) [RHEL-193254]
+- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (Jaroslav Kysela) [RHEL-193254]
+- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (Jaroslav Kysela) [RHEL-193254]
+- ASoC: codecs: aw88261: fix incorrect masks for boost regs (Jaroslav Kysela) [RHEL-193254]
+- ASoC: sma1307: Fix uevent string leaks in fault worker (Jaroslav Kysela) [RHEL-193254]
+- ALSA: aloop: Drop superfluous break (Jaroslav Kysela) [RHEL-193254]
+- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254]
+- ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: Clear variable event pointer on read (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: Fix partial userptr event expansion (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda: fix Kconfig dependency of HD Audio PCI (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: Initialize offload control return value (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: midi: Serialize output teardown with event_input (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (Jaroslav Kysela) [RHEL-193254]
+- ALSA: xen-front: Connect event channel after stream prepare (Jaroslav Kysela) [RHEL-193254]
+- ALSA: xen-front: Reset event channel state on stream clear (Jaroslav Kysela) [RHEL-193254]
+- ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda: Fix cached processing coefficient verbs (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda: conexant: Remove mic bias threshold override (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/realtek: Add quirk for TongFang X6xx45xU (Jaroslav Kysela) [RHEL-193254]
+- ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Roll back quirk control caches on write errors (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: avoid kobject path lookup in DualSense match (Jaroslav Kysela) [RHEL-193254] {CVE-2026-64478}
+- ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 (Jaroslav Kysela) [RHEL-193254]
+- KVM: s390: Fall back to short-term pinning in MAP ioctl (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: Enable adapter_indicators_set to use mapped pages (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: Add map/unmap ioctl and clean mappings post-guest (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: get rid of gmap_translate() (Christoph Schlameuss) [RHEL-136457]
+- selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-150728]
+- kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-150728]
+- selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-150728]
+- selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-150728]
+- selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-150728]
+- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-150728] {CVE-2026-43084}
+- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-150728]
+- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-150728]
+- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Luis Claudio R. Goncalves) [RHEL-186591]
+- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188519] {CVE-2026-53000}
+- kernel.spec.template: add tcp_ao kselftests (Davide Caratti) [RHEL-142637]
+- Kconfig: enable CONFIG_TCP_AO (Davide Caratti) [RHEL-142637]
+- tcp: Decrement tcp_md5_needed static branch (Davide Caratti) [RHEL-142637]
+- net/tcp-ao: fix use-after-free of key in del_async path (Davide Caratti) [RHEL-142637]
+- sockptr: fix usize check in copy_struct_from_sockptr() for user pointers (Davide Caratti) [RHEL-142637]
+- tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (Davide Caratti) [RHEL-142637]
+- tcp: restore RCU grace period in tcp_ao_destroy_sock (Davide Caratti) [RHEL-142637]
+- selftests/net: Synchronize client/server before counters checks (Davide Caratti) [RHEL-142637]
+- selftests/net: Fix various spelling mistakes in TCP-AO tests (Davide Caratti) [RHEL-142637]
+- tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Printing fixes to confirm with format-security (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Fix fscanf() call for format-security (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Zero-init tcp_ao_info_opt (Davide Caratti) [RHEL-142637]
+- selftests/net: Amend per-netns counter checks (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Make RST tests less flaky (Davide Caratti) [RHEL-142637]
+- selftests/net: Repair RST passive reset selftest (Davide Caratti) [RHEL-142637]
+- tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO. (Davide Caratti) [RHEL-142637]
+- tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). (Davide Caratti) [RHEL-142637]
+- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Davide Caratti) [RHEL-142637] {CVE-2025-39852}
+- selftests/net: Rectify key counters checks (Davide Caratti) [RHEL-142637]
+- selftests/net: Argument value mismatch when calling verify_counters() (Davide Caratti) [RHEL-142637]
+- selftests: tcp_ao: set the timeout to 2 minutes (Davide Caratti) [RHEL-142637]
+- selftests: tcp_ao: add a config file (Davide Caratti) [RHEL-142637]
+- selftests/net/tcp-ao: Use LDLIBS instead of LDFLAGS (Davide Caratti) [RHEL-142637]
+- net/tcp_sigpool: Use kref_get_unless_zero() (Davide Caratti) [RHEL-142637]
+- selftest/tcp-ao: Rectify out-of-tree build (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO key-management test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO selfconnect/simultaneous connect test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO RST test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add SEQ number extension test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP_REPAIR TCP-AO tests (Davide Caratti) [RHEL-142637]
+- selftests/net: Add test/benchmark for removing MKTs (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO + TCP-MD5 + no sign listen socket tests (Davide Caratti) [RHEL-142637]
+- selftests/net: Add test for TCP-AO add setsockopt() command (Davide Caratti) [RHEL-142637]
+- selftests/net: Add a test for TCP-AO keys matching (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO ICMPs accept test (Davide Caratti) [RHEL-142637]
+- selftests/net: Verify that TCP-AO complies with ignoring ICMPs (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO library (Davide Caratti) [RHEL-142637]
+- net/tcp-ao: Fix MAC comparison to be constant-time (Davide Caratti) [RHEL-142637] {CVE-2026-43384}
+- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Davide Caratti) [RHEL-142637] {CVE-2025-39950}
+- tcp: Free TCP-AO/TCP-MD5 info/keys without RCU (Davide Caratti) [RHEL-142637]
+- tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() (Davide Caratti) [RHEL-142637]
+- net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals (Davide Caratti) [RHEL-142637]
+- net/tcp: Disable TCP-AO static key after RCU grace period (Davide Caratti) [RHEL-142637] {CVE-2024-43887}
+- net/tcp_ao: Don't leak ao_info on error-path (Davide Caratti) [RHEL-142637] {CVE-2024-40985}
+- Documentation/tcp-ao: Add a few lines on tracepoints (Davide Caratti) [RHEL-142637]
+- net/tcp: Remove tcp_hash_fail() (Davide Caratti) [RHEL-142637]
+- net/tcp: Add tcp-md5 and tcp-ao tracepoints (Davide Caratti) [RHEL-142637]
+- net/tcp: Move tcp_inbound_hash() from headers (Davide Caratti) [RHEL-142637]
+- net/tcp: Add a helper tcp_ao_hdr_maclen() (Davide Caratti) [RHEL-142637]
+- net/tcp: Use static_branch_tcp_{md5,ao} to drop ifdefs (Davide Caratti) [RHEL-142637]
+- net/tcp: Only produce AO/MD5 logs if there are any keys (Davide Caratti) [RHEL-142637]
+- tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie(). (Davide Caratti) [RHEL-142637]
+- tcp: Cache sock_net(sk) in cookie_v[46]_check(). (Davide Caratti) [RHEL-142637]
+- net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED (Davide Caratti) [RHEL-142637]
+- tcp: Fix Use-After-Free in tcp_ao_connect_init (Davide Caratti) [RHEL-142637] {CVE-2024-27394}
+- net: tcp: remove call to obsolete crypto_ahash_alignmask() (Davide Caratti) [RHEL-142637]
+- net/tcp: Don't store TCP-AO maclen on reqsk (Davide Caratti) [RHEL-142637]
+- net/tcp: Don't add key with non-matching VRF on connected sockets (Davide Caratti) [RHEL-142637]
+- net/tcp: Limit TCP_AO_REPAIR to non-listen sockets (Davide Caratti) [RHEL-142637]
+- net/tcp: Consistently align TCP-AO option in the header (Davide Caratti) [RHEL-142637]
+- tcp: Fix SYN option room calculation for TCP-AO. (Davide Caratti) [RHEL-142637]
+- Documentation/tcp: Fix an obvious typo (Davide Caratti) [RHEL-142637]
+- tcp: Fix -Wc23-extensions in tcp_options_write() (Davide Caratti) [RHEL-142637]
+- net/tcp_sigpool: Fix some off by one bugs (Davide Caratti) [RHEL-142637]
+- net/tcp: fix possible out-of-bounds reads in tcp_hash_fail() (Davide Caratti) [RHEL-142637]
+- Documentation/tcp: Add TCP-AO documentation (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP_AO_REPAIR (Davide Caratti) [RHEL-142637]
+- net/tcp: Wire up l3index to TCP-AO (Davide Caratti) [RHEL-142637]
+- net/tcp: Add static_key for TCP-AO (Davide Caratti) [RHEL-142637]
+- net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO getsockopt()s (Davide Caratti) [RHEL-142637]
+- net/tcp: Add option for TCP-AO to (not) hash header (Davide Caratti) [RHEL-142637]
+- net/tcp: Ignore specific ICMPs for TCP-AO connections (Davide Caratti) [RHEL-142637]
+- net/tcp: Add tcp_hash_fail() ratelimited logs (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO SNE support (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO segments counters (Davide Caratti) [RHEL-142637]
+- net/tcp: Verify inbound TCP-AO signed segments (Davide Caratti) [RHEL-142637]
+- net/tcp: Sign SYN-ACK segments with TCP-AO (Davide Caratti) [RHEL-142637]
+- net/tcp: Wire TCP-AO to request sockets (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO sign to twsk (Davide Caratti) [RHEL-142637]
+- net/tcp: Add AO sign to RST packets (Davide Caratti) [RHEL-142637]
+- net/tcp: Add tcp_parse_auth_options() (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO sign to outgoing packets (Davide Caratti) [RHEL-142637]
+- net/tcp: Calculate TCP-AO traffic keys (Davide Caratti) [RHEL-142637]
+- net/tcp: Prevent TCP-MD5 with TCP-AO being set (Davide Caratti) [RHEL-142637]
+- net/tcp: Introduce TCP_AO setsockopt()s (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO config and structures (Davide Caratti) [RHEL-142637]
+- net/tcp: Prepare tcp_md5sig_pool for TCP-AO (Davide Caratti) [RHEL-142637]
+- tcp: Update stale comment for MD5 in tcp_parse_options(). (Davide Caratti) [RHEL-142637]
+- tcp: Disable header prediction for MD5 flow. (Davide Caratti) [RHEL-142637]
+- tcp: use 2-arg optimal variant of kfree_rcu() (Davide Caratti) [RHEL-142637]
+- net/tcp: Separate initialization of twsk (Davide Caratti) [RHEL-142637]
+- net/tcp: Do cleanup on tcp_md5_key_copy() failure (Davide Caratti) [RHEL-142637]
+- net/tcp: Disable TCP-MD5 static key on tcp_md5sig_info destruction (Davide Caratti) [RHEL-142637]
+- net/tcp: Separate tcp_md5sig_info allocation into tcp_md5sig_info_add() (Davide Caratti) [RHEL-142637]
+- tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0 (Davide Caratti) [RHEL-142637]
+- tcp: annotate data-race around tcp_md5sig_pool_populated (Davide Caratti) [RHEL-142637]
+- crypto: cipher - On clone do crypto_mod_get() (Davide Caratti) [RHEL-142637]
+- crypto: api - Add __crypto_alloc_tfmgfp (Davide Caratti) [RHEL-142637]
+- crypto: cmac - Add support for cloning (Davide Caratti) [RHEL-142637]
+- crypto: cipher - Add crypto_clone_cipher (Davide Caratti) [RHEL-142637]
+- crypto: cmac - Use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637]
+- crypto: shash - Allow cloning on algorithms with no init_tfm (Davide Caratti) [RHEL-142637]
+- crypto: cryptd - Add support for cloning hashes (Davide Caratti) [RHEL-142637]
+- crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637]
+- crypto: hmac - Add support for cloning (Davide Caratti) [RHEL-142637]
+- crypto: hash - Add crypto_clone_ahash/shash (Davide Caratti) [RHEL-142637]
+- crypto: api - Add crypto_clone_tfm (Davide Caratti) [RHEL-142637]
+- crypto: api - Add crypto_tfm_get (Davide Caratti) [RHEL-142637]
+- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (Petr Oros) [RHEL-155154]
+Resolves: RHEL-136457, RHEL-142637, RHEL-150728, RHEL-155154, RHEL-186591, RHEL-188519, RHEL-193254, RHEL-212652, RHEL-212707, RHEL-212719, RHEL-224339, RHEL-231655
+
 * Thu Aug 13 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-737.el9]
 - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-222675]
 - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224537]
diff --git a/kernel.spec b/kernel.spec
index c90165c31..80dfbea73 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -176,15 +176,15 @@ Summary: The Linux kernel
 # define buildid .local
 %define specversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 737
+%define pkgrelease 738
 %define kversion 5
-%define tarfile_release 5.14.0-737.el9
+%define tarfile_release 5.14.0-738.el9
 # This is needed to do merge window version magic
 %define patchlevel 14
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 737%{?buildid}%{?dist}
+%define specrelease 738%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 5.14.0-737.el9
+%define kabiversion 5.14.0-738.el9
 
 #
 # End of genspec.sh variables
@@ -2853,7 +2853,7 @@ fi
 pushd tools/testing/selftests
 # We need to install here because we need to call make with ARCH set which
 # doesn't seem possible to do in the install section.
-%{make} %{?_smp_mflags} ARCH=$Arch V=1 TARGETS="bpf cgroup kmod mm livepatch net net/forwarding net/hsr net/mptcp net/netfilter tc-testing memfd drivers/net/bonding iommu cachestat drivers/net" SKIP_TARGETS="" FORCE_TARGETS=1 INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" DEFAULT_INSTALL_HDR_PATH=0 install
+%{make} %{?_smp_mflags} ARCH=$Arch V=1 TARGETS="bpf cgroup kmod mm livepatch net net/forwarding net/hsr net/mptcp net/netfilter net/tcp_ao tc-testing memfd drivers/net/bonding iommu cachestat drivers/net" SKIP_TARGETS="" FORCE_TARGETS=1 INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" DEFAULT_INSTALL_HDR_PATH=0 install
 
 # 'make install' for bpf is broken and upstream refuses to fix it.
 # Install the needed files manually.
@@ -3238,6 +3238,12 @@ find -type d -exec install -d %{buildroot}%{_libexecdir}/kselftests/net/mptcp/{}
 find -type f -executable -exec install -D -m755 {} %{buildroot}%{_libexecdir}/kselftests/net/mptcp/{} \;
 find -type f ! -executable -exec install -D -m644 {} %{buildroot}%{_libexecdir}/kselftests/net/mptcp/{} \;
 popd
+# install net/tcp_ao selftests
+pushd tools/testing/selftests/net/tcp_ao
+find -type d -exec install -d %{buildroot}%{_libexecdir}/kselftests/net/tcp_ao/{} \;
+find -type f -executable -exec install -D -m755 {} %{buildroot}%{_libexecdir}/kselftests/net/tcp_ao/{} \;
+find -type f ! -executable -exec install -D -m644 {} %{buildroot}%{_libexecdir}/kselftests/net/tcp_ao/{} \;
+popd
 # install tc-testing selftests
 pushd tools/testing/selftests/tc-testing
 find -type d -exec install -d %{buildroot}%{_libexecdir}/kselftests/tc-testing/{} \;
@@ -3875,6 +3881,215 @@ fi
 #
 #
 %changelog
+* Mon Aug 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-738.el9]
+- scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339]
+- scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339]
+- scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl (Don Brace) [RHEL-224339]
+- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (Don Brace) [RHEL-224339]
+- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886}
+- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886}
+- platform/x86/intel/tpmi/plr: Prevent fault during unbind (Dennis Chen) [RHEL-212707]
+- platform/x86: intel: Add notifiers support (Dennis Chen) [RHEL-212707]
+- x86/fpu: Ensure XFD state on signal delivery (Dennis Chen) [RHEL-212652]
+- platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (Dennis Chen) [RHEL-212719]
+- ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Jaroslav Kysela) [RHEL-193254]
+- ASoC: amd: ps: disable MSI on resume in ACP PCI driver (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/tas2781: Cancel async firmware request at unbind (Jaroslav Kysela) [RHEL-193254]
+- firmware_loader: Add cancel helper for async requests (Jaroslav Kysela) [RHEL-193254]
+- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (Jaroslav Kysela) [RHEL-193254]
+- ALSA: scarlett2: Allow selecting config_set by firmware version (Jaroslav Kysela) [RHEL-193254]
+- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: topology: fix memory leak in snd_sof_load_topology (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: topology: validate vendor array size before parsing (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc4-control: Validate notification payload size (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (Jaroslav Kysela) [RHEL-193254]
+- ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 (Jaroslav Kysela) [RHEL-193254]
+- ALSA: FCP: Fix NULL pointer dereference in interface lookup (Jaroslav Kysela) [RHEL-193254]
+- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SDCA: Validate written enum value in ge_put_enum_double() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: clear opened when stream enable fails (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: reject stream disable with no active interface (Jaroslav Kysela) [RHEL-193254]
+- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: Free sideband sg_table objects (Jaroslav Kysela) [RHEL-193254]
+- soundwire: intel_ace2x: release bpt_stream when close it (Jaroslav Kysela) [RHEL-193254]
+- soundwire: fix bug in sdw_add_element_group_count found by syzkaller (Jaroslav Kysela) [RHEL-193254]
+- soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral (Jaroslav Kysela) [RHEL-193254]
+- mfd: cs42l43: Sanity check firmware size (Jaroslav Kysela) [RHEL-193254]
+- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: avoid stale FIFO cells during resize (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: oss: Serialize readq reset state with q->lock (Jaroslav Kysela) [RHEL-193254]
+- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: Guard sideband endpoint removal (Jaroslav Kysela) [RHEL-193254]
+- ASoC: topology: Check PCM and DAI name strings before use (Jaroslav Kysela) [RHEL-193254]
+- ASoC: tegra: tegra210_ahub: Validate written enum value (Jaroslav Kysela) [RHEL-193254]
+- ASoC: fsl: fsl_audmix: Validate written enum values (Jaroslav Kysela) [RHEL-193254]
+- ASoC: meson: aiu: Validate written enum values (Jaroslav Kysela) [RHEL-193254]
+- ASoC: codecs: hdac_hdmi: Validate written enum value (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly (Jaroslav Kysela) [RHEL-193254]
+- ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from SND_SOC_SOF_HDA_GENERIC=y (Jaroslav Kysela) [RHEL-193254]
+- ASoC: cs35l56: Fix wrong error test on simple_write_to_buffer() (Jaroslav Kysela) [RHEL-193254]
+- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (Jaroslav Kysela) [RHEL-193254]
+- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (Jaroslav Kysela) [RHEL-193254]
+- ASoC: codecs: aw88261: fix incorrect masks for boost regs (Jaroslav Kysela) [RHEL-193254]
+- ASoC: sma1307: Fix uevent string leaks in fault worker (Jaroslav Kysela) [RHEL-193254]
+- ALSA: aloop: Drop superfluous break (Jaroslav Kysela) [RHEL-193254]
+- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254]
+- ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: Clear variable event pointer on read (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: Fix partial userptr event expansion (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda: fix Kconfig dependency of HD Audio PCI (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: qcom: Initialize offload control return value (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: midi: Serialize output teardown with event_input (Jaroslav Kysela) [RHEL-193254]
+- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (Jaroslav Kysela) [RHEL-193254]
+- ALSA: xen-front: Connect event channel after stream prepare (Jaroslav Kysela) [RHEL-193254]
+- ALSA: xen-front: Reset event channel state on stream clear (Jaroslav Kysela) [RHEL-193254]
+- ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda: Fix cached processing coefficient verbs (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda: conexant: Remove mic bias threshold override (Jaroslav Kysela) [RHEL-193254]
+- ALSA: hda/realtek: Add quirk for TongFang X6xx45xU (Jaroslav Kysela) [RHEL-193254]
+- ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Roll back quirk control caches on write errors (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (Jaroslav Kysela) [RHEL-193254]
+- ALSA: usb-audio: avoid kobject path lookup in DualSense match (Jaroslav Kysela) [RHEL-193254] {CVE-2026-64478}
+- ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 (Jaroslav Kysela) [RHEL-193254]
+- KVM: s390: Fall back to short-term pinning in MAP ioctl (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: Enable adapter_indicators_set to use mapped pages (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: Add map/unmap ioctl and clean mappings post-guest (Christoph Schlameuss) [RHEL-136457]
+- KVM: s390: get rid of gmap_translate() (Christoph Schlameuss) [RHEL-136457]
+- selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-150728]
+- kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-150728]
+- selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-150728]
+- selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-150728]
+- selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-150728]
+- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-150728] {CVE-2026-43084}
+- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-150728]
+- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-150728]
+- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Luis Claudio R. Goncalves) [RHEL-186591]
+- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188519] {CVE-2026-53000}
+- kernel.spec.template: add tcp_ao kselftests (Davide Caratti) [RHEL-142637]
+- Kconfig: enable CONFIG_TCP_AO (Davide Caratti) [RHEL-142637]
+- tcp: Decrement tcp_md5_needed static branch (Davide Caratti) [RHEL-142637]
+- net/tcp-ao: fix use-after-free of key in del_async path (Davide Caratti) [RHEL-142637]
+- sockptr: fix usize check in copy_struct_from_sockptr() for user pointers (Davide Caratti) [RHEL-142637]
+- tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (Davide Caratti) [RHEL-142637]
+- tcp: restore RCU grace period in tcp_ao_destroy_sock (Davide Caratti) [RHEL-142637]
+- selftests/net: Synchronize client/server before counters checks (Davide Caratti) [RHEL-142637]
+- selftests/net: Fix various spelling mistakes in TCP-AO tests (Davide Caratti) [RHEL-142637]
+- tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Printing fixes to confirm with format-security (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Fix fscanf() call for format-security (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Zero-init tcp_ao_info_opt (Davide Caratti) [RHEL-142637]
+- selftests/net: Amend per-netns counter checks (Davide Caratti) [RHEL-142637]
+- selftests/tcp_ao: Make RST tests less flaky (Davide Caratti) [RHEL-142637]
+- selftests/net: Repair RST passive reset selftest (Davide Caratti) [RHEL-142637]
+- tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO. (Davide Caratti) [RHEL-142637]
+- tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). (Davide Caratti) [RHEL-142637]
+- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Davide Caratti) [RHEL-142637] {CVE-2025-39852}
+- selftests/net: Rectify key counters checks (Davide Caratti) [RHEL-142637]
+- selftests/net: Argument value mismatch when calling verify_counters() (Davide Caratti) [RHEL-142637]
+- selftests: tcp_ao: set the timeout to 2 minutes (Davide Caratti) [RHEL-142637]
+- selftests: tcp_ao: add a config file (Davide Caratti) [RHEL-142637]
+- selftests/net/tcp-ao: Use LDLIBS instead of LDFLAGS (Davide Caratti) [RHEL-142637]
+- net/tcp_sigpool: Use kref_get_unless_zero() (Davide Caratti) [RHEL-142637]
+- selftest/tcp-ao: Rectify out-of-tree build (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO key-management test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO selfconnect/simultaneous connect test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO RST test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add SEQ number extension test (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP_REPAIR TCP-AO tests (Davide Caratti) [RHEL-142637]
+- selftests/net: Add test/benchmark for removing MKTs (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO + TCP-MD5 + no sign listen socket tests (Davide Caratti) [RHEL-142637]
+- selftests/net: Add test for TCP-AO add setsockopt() command (Davide Caratti) [RHEL-142637]
+- selftests/net: Add a test for TCP-AO keys matching (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO ICMPs accept test (Davide Caratti) [RHEL-142637]
+- selftests/net: Verify that TCP-AO complies with ignoring ICMPs (Davide Caratti) [RHEL-142637]
+- selftests/net: Add TCP-AO library (Davide Caratti) [RHEL-142637]
+- net/tcp-ao: Fix MAC comparison to be constant-time (Davide Caratti) [RHEL-142637] {CVE-2026-43384}
+- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Davide Caratti) [RHEL-142637] {CVE-2025-39950}
+- tcp: Free TCP-AO/TCP-MD5 info/keys without RCU (Davide Caratti) [RHEL-142637]
+- tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() (Davide Caratti) [RHEL-142637]
+- net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals (Davide Caratti) [RHEL-142637]
+- net/tcp: Disable TCP-AO static key after RCU grace period (Davide Caratti) [RHEL-142637] {CVE-2024-43887}
+- net/tcp_ao: Don't leak ao_info on error-path (Davide Caratti) [RHEL-142637] {CVE-2024-40985}
+- Documentation/tcp-ao: Add a few lines on tracepoints (Davide Caratti) [RHEL-142637]
+- net/tcp: Remove tcp_hash_fail() (Davide Caratti) [RHEL-142637]
+- net/tcp: Add tcp-md5 and tcp-ao tracepoints (Davide Caratti) [RHEL-142637]
+- net/tcp: Move tcp_inbound_hash() from headers (Davide Caratti) [RHEL-142637]
+- net/tcp: Add a helper tcp_ao_hdr_maclen() (Davide Caratti) [RHEL-142637]
+- net/tcp: Use static_branch_tcp_{md5,ao} to drop ifdefs (Davide Caratti) [RHEL-142637]
+- net/tcp: Only produce AO/MD5 logs if there are any keys (Davide Caratti) [RHEL-142637]
+- tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie(). (Davide Caratti) [RHEL-142637]
+- tcp: Cache sock_net(sk) in cookie_v[46]_check(). (Davide Caratti) [RHEL-142637]
+- net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED (Davide Caratti) [RHEL-142637]
+- tcp: Fix Use-After-Free in tcp_ao_connect_init (Davide Caratti) [RHEL-142637] {CVE-2024-27394}
+- net: tcp: remove call to obsolete crypto_ahash_alignmask() (Davide Caratti) [RHEL-142637]
+- net/tcp: Don't store TCP-AO maclen on reqsk (Davide Caratti) [RHEL-142637]
+- net/tcp: Don't add key with non-matching VRF on connected sockets (Davide Caratti) [RHEL-142637]
+- net/tcp: Limit TCP_AO_REPAIR to non-listen sockets (Davide Caratti) [RHEL-142637]
+- net/tcp: Consistently align TCP-AO option in the header (Davide Caratti) [RHEL-142637]
+- tcp: Fix SYN option room calculation for TCP-AO. (Davide Caratti) [RHEL-142637]
+- Documentation/tcp: Fix an obvious typo (Davide Caratti) [RHEL-142637]
+- tcp: Fix -Wc23-extensions in tcp_options_write() (Davide Caratti) [RHEL-142637]
+- net/tcp_sigpool: Fix some off by one bugs (Davide Caratti) [RHEL-142637]
+- net/tcp: fix possible out-of-bounds reads in tcp_hash_fail() (Davide Caratti) [RHEL-142637]
+- Documentation/tcp: Add TCP-AO documentation (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP_AO_REPAIR (Davide Caratti) [RHEL-142637]
+- net/tcp: Wire up l3index to TCP-AO (Davide Caratti) [RHEL-142637]
+- net/tcp: Add static_key for TCP-AO (Davide Caratti) [RHEL-142637]
+- net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO getsockopt()s (Davide Caratti) [RHEL-142637]
+- net/tcp: Add option for TCP-AO to (not) hash header (Davide Caratti) [RHEL-142637]
+- net/tcp: Ignore specific ICMPs for TCP-AO connections (Davide Caratti) [RHEL-142637]
+- net/tcp: Add tcp_hash_fail() ratelimited logs (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO SNE support (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO segments counters (Davide Caratti) [RHEL-142637]
+- net/tcp: Verify inbound TCP-AO signed segments (Davide Caratti) [RHEL-142637]
+- net/tcp: Sign SYN-ACK segments with TCP-AO (Davide Caratti) [RHEL-142637]
+- net/tcp: Wire TCP-AO to request sockets (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO sign to twsk (Davide Caratti) [RHEL-142637]
+- net/tcp: Add AO sign to RST packets (Davide Caratti) [RHEL-142637]
+- net/tcp: Add tcp_parse_auth_options() (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO sign to outgoing packets (Davide Caratti) [RHEL-142637]
+- net/tcp: Calculate TCP-AO traffic keys (Davide Caratti) [RHEL-142637]
+- net/tcp: Prevent TCP-MD5 with TCP-AO being set (Davide Caratti) [RHEL-142637]
+- net/tcp: Introduce TCP_AO setsockopt()s (Davide Caratti) [RHEL-142637]
+- net/tcp: Add TCP-AO config and structures (Davide Caratti) [RHEL-142637]
+- net/tcp: Prepare tcp_md5sig_pool for TCP-AO (Davide Caratti) [RHEL-142637]
+- tcp: Update stale comment for MD5 in tcp_parse_options(). (Davide Caratti) [RHEL-142637]
+- tcp: Disable header prediction for MD5 flow. (Davide Caratti) [RHEL-142637]
+- tcp: use 2-arg optimal variant of kfree_rcu() (Davide Caratti) [RHEL-142637]
+- net/tcp: Separate initialization of twsk (Davide Caratti) [RHEL-142637]
+- net/tcp: Do cleanup on tcp_md5_key_copy() failure (Davide Caratti) [RHEL-142637]
+- net/tcp: Disable TCP-MD5 static key on tcp_md5sig_info destruction (Davide Caratti) [RHEL-142637]
+- net/tcp: Separate tcp_md5sig_info allocation into tcp_md5sig_info_add() (Davide Caratti) [RHEL-142637]
+- tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0 (Davide Caratti) [RHEL-142637]
+- tcp: annotate data-race around tcp_md5sig_pool_populated (Davide Caratti) [RHEL-142637]
+- crypto: cipher - On clone do crypto_mod_get() (Davide Caratti) [RHEL-142637]
+- crypto: api - Add __crypto_alloc_tfmgfp (Davide Caratti) [RHEL-142637]
+- crypto: cmac - Add support for cloning (Davide Caratti) [RHEL-142637]
+- crypto: cipher - Add crypto_clone_cipher (Davide Caratti) [RHEL-142637]
+- crypto: cmac - Use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637]
+- crypto: shash - Allow cloning on algorithms with no init_tfm (Davide Caratti) [RHEL-142637]
+- crypto: cryptd - Add support for cloning hashes (Davide Caratti) [RHEL-142637]
+- crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637]
+- crypto: hmac - Add support for cloning (Davide Caratti) [RHEL-142637]
+- crypto: hash - Add crypto_clone_ahash/shash (Davide Caratti) [RHEL-142637]
+- crypto: api - Add crypto_clone_tfm (Davide Caratti) [RHEL-142637]
+- crypto: api - Add crypto_tfm_get (Davide Caratti) [RHEL-142637]
+- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (Petr Oros) [RHEL-155154]
+
 * Thu Aug 13 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-737.el9]
 - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-222675]
 - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224537]
diff --git a/sources b/sources
index 1cff7512d..ba07b0bc2 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-5.14.0-737.el9.tar.xz) = 59a6b21b3dfb02b6ef8e316fbcaa008a843223a5b6175397569ba6a6ab402b16f04c052c52ae8c65658262ff854f0dfc1ce058804396694bade3ccccc20d095e
-SHA512 (kernel-abi-stablelists-5.14.0-737.el9.tar.bz2) = cf2f7e8ceb69b9c9efdca4454781928de8d9c5ce3405ec165e4ea6083795b121925599156f2cb1595e87ef2c30540836b53813e6a2ab433521d6cbf33a14302f
-SHA512 (kernel-kabi-dw-5.14.0-737.el9.tar.bz2) = bc30568711dd0d7566b4281d1d354fe26752a024cc1c2a84006a4f5942a6efb9eedc255dc4aba4ecdd40bb98ade376b5828445c80ead3c271969ec551613504c
+SHA512 (linux-5.14.0-738.el9.tar.xz) = 953c78914af5ebd06205fa70ddef9efaa8dc16b9cae686b2ee759827734d7eb4509df95651443c5e8d7fdc414bd3b8bc2e92278a17d0aef1f9a905f000c4e107
+SHA512 (kernel-abi-stablelists-5.14.0-738.el9.tar.bz2) = 6de983b72caa87b2ff19d029859304f990b34924cf10ebc72d5ac92c77098aa2618d532969220e60ba7cdea8efa58ee03cdddc0cacd8c2e6377c4b56bb9da3fb
+SHA512 (kernel-kabi-dw-5.14.0-738.el9.tar.bz2) = a6b8aa58146d43d43b062e734f2fa0f08a093b7e7e36076f45c4c280b71c20628cb910fea5a960b75a72fa7fb2bc72172f2eac6cc3bfd21329c34f0593783dc2