diff --git a/kernel.spec b/kernel.spec
index 21f19c11b..86b4731e6 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.86.1.el8_10
+%define pkgrelease 553.87.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.86.1%{?dist}
+%define specrelease 553.87.1%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -2705,6 +2705,11 @@ fi
 #
 #
 %changelog
+* Tue Nov 25 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.87.1.el8_10]
+- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664]
+- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955}
+- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883}
+
 * Thu Nov 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.86.1.el8_10]
 - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825}
 - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237]
diff --git a/sources b/sources
index b142f2014..f38271f4d 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-553.86.1.el8_10.tar.xz) = 3dffd29cd45498cfb212280b105f244e6517b008ab99aac79aff8d5105ce133dc6bc94098cab1582955ec18df0a396e9479c0b4eb21307b4f899d315333d4e0b
-SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 2641edfe44724f10fe8125c082431a219b75ad9d94af47767c67cab03917a01e74258f92700a985ea79be21afb577069658afd3e68d495bfeda3d13572bd36d0
-SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = 23592241cd5a316f2b23a9732e8ea41ef5994550962e4f112bc47107814407721a3524082a9d463ad0c492ddc31aed18bb918525273419f070c0499f75ab1a82
+SHA512 (linux-4.18.0-553.87.1.el8_10.tar.xz) = 8b6a38b128ff105d2ef7edc48e0c7decf5ad49f3ea8e2df5e90031e3791098ea63b4a59a51836087f08cd983aa6ac46f1cc8410cd99a2b3f97c7023e1b7b71a9
+SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = d240ce502a69bacfc7b7a63cfe1b336ff002699cc12a8dd7e26fa22e1e5cdb8945d51d1c63117c106e510030317beb351fe84766f4a6bc7dbc3341ca8847cbb0
+SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = a97efd4f6e52463ade4d18e1309b1d953560411051895be8b47cacb7315a7aff2ccbeb4dd919679d5d864c7ffeb89ac8e0cffe9538b55c1c6a7cc39548d50403