diff --git a/kernel.spec b/kernel.spec
index 3a8e944e9..5575f7a36 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.52.1.el8_10
+%define pkgrelease 553.53.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.52.1%{?dist}
+%define specrelease 553.53.1%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -2696,6 +2696,25 @@ fi
 #
 #
 %changelog
+* Fri May 09 2025 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.53.1.el8_10]
+- net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906}
+- net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712]
+- net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970}
+- net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717}
+- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819]
+- platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714]
+- platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714]
+- x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793]
+- vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756}
+- vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756}
+- bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756}
+
 * Thu May 01 2025 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.52.1.el8_10.gfd1b]
 - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141}
 - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285]
diff --git a/sources b/sources
index 85cef591a..b91dd4569 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-553.52.1.el8_10.tar.xz) = ce07b0670dc809d2acac663b4b98c030f9a955b7e68eb3626b30d6669db728289f67c2880b195aed7d6a3f6998f9fb3a5baac4b14438f82d8079cc9adf70008f
-SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = e0a044c7cef906542d1d5e4d5c78033952129e1ee2c01f947dbb7bbd5c9668c64e91d35a2515547e58c6b17ce243a1f008625cf93c4e47c17590213d92651306
+SHA512 (linux-4.18.0-553.53.1.el8_10.tar.xz) = 4255f4e72de12d5634cc3d883c4a09919d87e5d3a5a0d5aed32441789811c86a2b6788771d3d10c99b31b22a659aba2b05d591bd465e6d3e8bb40901010d33d4
+SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 7c0f701244c9cfe561c5851619d96693c49405020bef9e2e30b63e64adea72e5acc41dc70b396a549a24da7e9ca971f35865d5bec8eca15eb8c01914095d997e
 SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = 79a9788af0c183f670166700354b6a188c176427a6230b8bfaa2cfdc6a4daa1418bbee98d80b7f6b3195043eeef1ffa6782d03b5a1733b65a90c22f66684941f