diff --git a/kernel.spec b/kernel.spec
index d1d371afa..89715a424 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.60.1.el8_10
+%define pkgrelease 553.61.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.60.1%{?dist}
+%define specrelease 553.61.1%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -2696,6 +2696,13 @@ fi
 #
 #
 %changelog
+* Thu Jul 03 2025 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.61.1.el8_10]
+- s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409]
+- ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738}
+- ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150}
+- net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004}
+- x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991}
+
 * Thu Jun 26 2025 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.60.1.el8_10]
 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037]
 - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037]
diff --git a/sources b/sources
index bf3477857..22a69527a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (linux-4.18.0-553.60.1.el8_10.tar.xz) = 54a14eed92149706f08630dfc63244397cafea116c8218c287d2063563b31bf7b18c9efaeb965db570a6baafdf2e0e5716507a6d3541d1171a4f5497c509f451
-SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = d6c771bf71f415c85c59237414805b0446ca2d16b4ac3f0005a0b4ad4f99c4b43002b890133c123167a42e186513ef4633b7021544b659648778112b8b04f856
+SHA512 (linux-4.18.0-553.61.1.el8_10.tar.xz) = 4cb6ab860df6ac2439c3527f29fb7e4baf5c426688d772d9f80e5268607c16e584dfb1c2d84a33ef5ee8435ee2ef81b02d08c7d96b3092e4fddea45980c5d6bf
+SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 10195d5b2cfea4a19e9ec64c84d538125bd44e60b7b3b087870ca83c1a5d6fce2e5f39875c11d9e3641f70b7fffeb44f26c4ecd2d0b90ef7529182e94259b6c6
 SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = 79a9788af0c183f670166700354b6a188c176427a6230b8bfaa2cfdc6a4daa1418bbee98d80b7f6b3195043eeef1ffa6782d03b5a1733b65a90c22f66684941f