diff --git a/COPYING-6.12.0-55.30.1.el10_0 b/COPYING-6.12.0-55.32.1.el10_0
similarity index 100%
rename from COPYING-6.12.0-55.30.1.el10_0
rename to COPYING-6.12.0-55.32.1.el10_0
diff --git a/Makefile.rhelver b/Makefile.rhelver
index 776a64b1f1853..6af39a99f9248 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 0
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 55.30.1
+RHEL_RELEASE = 55.32.1
 
 #
 # RHEL_REBASE_NUM
diff --git a/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/00817f0f.failed b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/00817f0f.failed
new file mode 100644
index 0000000000000..46a3930d4c031
--- /dev/null
+++ b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/00817f0f.failed
@@ -0,0 +1,53 @@
+nvme-ioctl: fix leaked requests on mapping error
+
+jira LE-4192
+Rebuild_History Non-Buildable kernel-6.12.0-55.31.1.el10_0
+commit-author Keith Busch <kbusch@kernel.org>
+commit 00817f0f1c45b007965f5676b9a2013bb39c7228
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/00817f0f.failed
+
+All the callers assume nvme_map_user_request() frees the request on a
+failure. This wasn't happening on invalid metadata or io_uring command
+flags, so we've been leaking those requests.
+
+Fixes: 23fd22e55b767b ("nvme: wire up fixed buffer support for nvme passthrough")
+Fixes: 7c2fd76048e95d ("nvme: fix metadata handling in nvme-passthrough")
+	Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+	Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
+	Reviewed-by: Christoph Hellwig <hch@lst.de>
+	Signed-off-by: Keith Busch <kbusch@kernel.org>
+(cherry picked from commit 00817f0f1c45b007965f5676b9a2013bb39c7228)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/nvme/host/ioctl.c
+diff --cc drivers/nvme/host/ioctl.c
+index a96976b22fa7,24e2c702da7a..000000000000
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@@ -124,8 -125,17 +124,22 @@@ static int nvme_map_user_request(struc
+  	struct bio *bio = NULL;
+  	int ret;
+  
+++<<<<<<< HEAD
+ +	if (has_metadata && !supports_metadata)
+ +		return -EINVAL;
+++=======
++ 	if (!nvme_ctrl_sgl_supported(ctrl))
++ 		dev_warn_once(ctrl->device, "using unchecked data buffer\n");
++ 	if (has_metadata) {
++ 		if (!supports_metadata) {
++ 			ret = -EINVAL;
++ 			goto out;
++ 		}
++ 		if (!nvme_ctrl_meta_sgl_supported(ctrl))
++ 			dev_warn_once(ctrl->device,
++ 				      "using unchecked metadata buffer\n");
++ 	}
+++>>>>>>> 00817f0f1c45 (nvme-ioctl: fix leaked requests on mapping error)
+  
+  	if (ioucmd && (ioucmd->flags & IORING_URING_CMD_FIXED)) {
+  		struct iov_iter iter;
+* Unmerged path drivers/nvme/host/ioctl.c
diff --git a/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/021ba7f1.failed b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/021ba7f1.failed
new file mode 100644
index 0000000000000..4eb67b3027e54
--- /dev/null
+++ b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/021ba7f1.failed
@@ -0,0 +1,57 @@
+udmabuf: fix a buf size overflow issue during udmabuf creation
+
+jira LE-4192
+cve CVE-2025-37803
+Rebuild_History Non-Buildable kernel-6.12.0-55.31.1.el10_0
+commit-author Xiaogang Chen <xiaogang.chen@amd.com>
+commit 021ba7f1babd029e714d13a6bf2571b08af96d0f
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/021ba7f1.failed
+
+by casting size_limit_mb to u64  when calculate pglimit.
+
+	Signed-off-by: Xiaogang Chen<Xiaogang.Chen@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250321164126.329638-1-xiaogang.chen@amd.com
+	Signed-off-by: Christian König <christian.koenig@amd.com>
+(cherry picked from commit 021ba7f1babd029e714d13a6bf2571b08af96d0f)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/dma-buf/udmabuf.c
+diff --cc drivers/dma-buf/udmabuf.c
+index 5e836e4e5b44,e74e36a8ecda..000000000000
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@@ -358,17 -393,21 +358,21 @@@ static long udmabuf_create(struct miscd
+  	if (!ubuf)
+  		return -ENOMEM;
+  
+++<<<<<<< HEAD
+ +	INIT_LIST_HEAD(&ubuf->unpin_list);
+ +	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+++=======
++ 	pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+++>>>>>>> 021ba7f1babd (udmabuf: fix a buf size overflow issue during udmabuf creation)
+  	for (i = 0; i < head->count; i++) {
+ -		pgoff_t subpgcnt;
+ -
+  		if (!PAGE_ALIGNED(list[i].offset))
+ -			goto err_noinit;
+ +			goto err;
+  		if (!PAGE_ALIGNED(list[i].size))
+ -			goto err_noinit;
+ +			goto err;
+  
+ -		subpgcnt = list[i].size >> PAGE_SHIFT;
+ -		pgcnt += subpgcnt;
+ +		pgcnt += list[i].size >> PAGE_SHIFT;
+  		if (pgcnt > pglimit)
+ -			goto err_noinit;
+ -
+ -		max_nr_folios = max_t(unsigned long, subpgcnt, max_nr_folios);
+ +			goto err;
+  	}
+  
+  	if (!pgcnt)
+* Unmerged path drivers/dma-buf/udmabuf.c
diff --git a/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/eada7546.failed b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/eada7546.failed
new file mode 100644
index 0000000000000..2231451125a20
--- /dev/null
+++ b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/eada7546.failed
@@ -0,0 +1,50 @@
+nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
+
+jira LE-4192
+Rebuild_History Non-Buildable kernel-6.12.0-55.31.1.el10_0
+commit-author Caleb Sander Mateos <csander@purestorage.com>
+commit eada75467fca0b016b9b22212637c07216135c20
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/eada7546.failed
+
+The vectorized io_uring NVMe passthru opcodes don't yet support fixed
+buffers. But since userspace can trigger this condition based on the
+io_uring SQE parameters, it shouldn't cause a kernel warning.
+
+	Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+	Reviewed-by: Jens Axboe <axboe@kernel.dk>
+	Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+	Reviewed-by: Christoph Hellwig <hch@lst.de>
+Fixes: 23fd22e55b76 ("nvme: wire up fixed buffer support for nvme passthrough")
+	Signed-off-by: Keith Busch <kbusch@kernel.org>
+(cherry picked from commit eada75467fca0b016b9b22212637c07216135c20)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/nvme/host/ioctl.c
+diff --cc drivers/nvme/host/ioctl.c
+index a96976b22fa7,f81748096841..000000000000
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@@ -131,10 -142,13 +131,17 @@@ static int nvme_map_user_request(struc
+  		struct iov_iter iter;
+  
+  		/* fixedbufs is only for non-vectored io */
+++<<<<<<< HEAD
+ +		if (WARN_ON_ONCE(flags & NVME_IOCTL_VEC))
+ +			return -EINVAL;
+++=======
++ 		if (flags & NVME_IOCTL_VEC) {
++ 			ret = -EINVAL;
++ 			goto out;
++ 		}
+++>>>>>>> eada75467fca (nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer)
+  		ret = io_uring_cmd_import_fixed(ubuffer, bufflen,
+ -				rq_data_dir(req), &iter, ioucmd,
+ -				iou_issue_flags);
+ +				rq_data_dir(req), &iter, ioucmd);
+  		if (ret < 0)
+  			goto out;
+  		ret = blk_rq_map_user_iov(q, req, NULL, &iter, GFP_KERNEL);
+* Unmerged path drivers/nvme/host/ioctl.c
diff --git a/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/rebuild.details.txt b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/rebuild.details.txt
new file mode 100644
index 0000000000000..86882ea8247f7
--- /dev/null
+++ b/ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/rebuild.details.txt
@@ -0,0 +1,23 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v6.12~1..kernel-mainline: 66177
+Number of commits in rpm: 22
+Number of commits matched with upstream: 18 (81.82%)
+Number of commits in upstream but not in rpm: 66159
+Number of commits NOT found in upstream: 4 (18.18%)
+
+Rebuilding Kernel on Branch rocky10_0_rebuild_kernel-6.12.0-55.31.1.el10_0 for kernel-6.12.0-55.31.1.el10_0
+Clean Cherry Picks: 10 (55.56%)
+Empty Cherry Picks: 3 (16.67%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+00817f0f1c45b007965f5676b9a2013bb39c7228 nvme-ioctl: fix leaked requests on mapping error
+eada75467fca0b016b9b22212637c07216135c20 nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
+021ba7f1babd029e714d13a6bf2571b08af96d0f udmabuf: fix a buf size overflow issue during udmabuf creation
+
+__CHANGES NOT IN UPSTREAM________________
+Porting to Rocky Linux 10, debranding and Rocky Linux branding'
+Add partial riscv64 support for build root'
+Provide basic VisionFive 2 support'
+Revert "cxl/acpi: Fix load failures due to single window creation failure"
diff --git a/ciq/ciq_backports/kernel-6.12.0-55.32.1.el10_0/rebuild.details.txt b/ciq/ciq_backports/kernel-6.12.0-55.32.1.el10_0/rebuild.details.txt
new file mode 100644
index 0000000000000..5bb2cb30aca25
--- /dev/null
+++ b/ciq/ciq_backports/kernel-6.12.0-55.32.1.el10_0/rebuild.details.txt
@@ -0,0 +1,19 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v6.12~1..kernel-mainline: 66177
+Number of commits in rpm: 4
+Number of commits matched with upstream: 1 (25.00%)
+Number of commits in upstream but not in rpm: 66176
+Number of commits NOT found in upstream: 3 (75.00%)
+
+Rebuilding Kernel on Branch rocky10_0_rebuild_kernel-6.12.0-55.32.1.el10_0 for kernel-6.12.0-55.32.1.el10_0
+Clean Cherry Picks: 1 (100.00%)
+Empty Cherry Picks: 0 (0.00%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+
+__CHANGES NOT IN UPSTREAM________________
+Porting to Rocky Linux 10, debranding and Rocky Linux branding'
+Add partial riscv64 support for build root'
+Provide basic VisionFive 2 support'
diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 432b7cfd12a8e..483482e4fcfbd 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -340,20 +340,24 @@ static int add_or_reset_cxl_resource(struct resource *parent, struct resource *r
 DEFINE_FREE(put_cxlrd, struct cxl_root_decoder *,
 	    if (!IS_ERR_OR_NULL(_T)) put_device(&_T->cxlsd.cxld.dev))
 DEFINE_FREE(del_cxl_resource, struct resource *, if (_T) del_cxl_resource(_T))
-static int __cxl_parse_cfmws(struct acpi_cedt_cfmws *cfmws,
-			     struct cxl_cfmws_context *ctx)
+static int cxl_parse_cfmws(union acpi_subtable_headers *header, void *arg,
+			   const unsigned long end)
 {
 	int target_map[CXL_DECODER_MAX_INTERLEAVE];
+	struct cxl_cfmws_context *ctx = arg;
 	struct cxl_port *root_port = ctx->root_port;
 	struct cxl_cxims_context cxims_ctx;
 	struct device *dev = ctx->dev;
+	struct acpi_cedt_cfmws *cfmws;
 	struct cxl_decoder *cxld;
 	unsigned int ways, i, ig;
 	int rc;
 
+	cfmws = (struct acpi_cedt_cfmws *) header;
+
 	rc = cxl_acpi_cfmws_verify(dev, cfmws);
 	if (rc)
-		return rc;
+		return 0;
 
 	rc = eiw_to_ways(cfmws->interleave_ways, &ways);
 	if (rc)
@@ -378,7 +382,7 @@ static int __cxl_parse_cfmws(struct acpi_cedt_cfmws *cfmws,
 		cxl_root_decoder_alloc(root_port, ways);
 
 	if (IS_ERR(cxlrd))
-		return PTR_ERR(cxlrd);
+		return 0;
 
 	cxld = &cxlrd->cxlsd.cxld;
 	cxld->flags = cfmws_to_decoder_flags(cfmws->restrictions);
@@ -421,29 +425,16 @@ static int __cxl_parse_cfmws(struct acpi_cedt_cfmws *cfmws,
 	rc = cxl_decoder_add(cxld, target_map);
 	if (rc)
 		return rc;
-	return cxl_root_decoder_autoremove(dev, no_free_ptr(cxlrd));
-}
-
-static int cxl_parse_cfmws(union acpi_subtable_headers *header, void *arg,
-			   const unsigned long end)
-{
-	struct acpi_cedt_cfmws *cfmws = (struct acpi_cedt_cfmws *)header;
-	struct cxl_cfmws_context *ctx = arg;
-	struct device *dev = ctx->dev;
-	int rc;
-
-	rc = __cxl_parse_cfmws(cfmws, ctx);
-	if (rc)
-		dev_err(dev,
-			"Failed to add decode range: [%#llx - %#llx] (%d)\n",
-			cfmws->base_hpa,
-			cfmws->base_hpa + cfmws->window_size - 1, rc);
-	else
-		dev_dbg(dev, "decode range: node: %d range [%#llx - %#llx]\n",
-			phys_to_target_node(cfmws->base_hpa), cfmws->base_hpa,
-			cfmws->base_hpa + cfmws->window_size - 1);
+	rc = cxl_root_decoder_autoremove(dev, no_free_ptr(cxlrd));
+	if (rc) {
+		dev_err(dev, "Failed to add decode range: %pr", res);
+		return rc;
+	}
+	dev_dbg(dev, "add: %s node: %d range [%#llx - %#llx]\n",
+		dev_name(&cxld->dev),
+		phys_to_target_node(cxld->hpa_range.start),
+		cxld->hpa_range.start, cxld->hpa_range.end);
 
-	/* never fail cxl_acpi load for a single window failure */
 	return 0;
 }
 
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 5e836e4e5b449..a7d4b35b4101f 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -359,7 +359,7 @@ static long udmabuf_create(struct miscdevice *device,
 		return -ENOMEM;
 
 	INIT_LIST_HEAD(&ubuf->unpin_list);
-	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+	pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 	for (i = 0; i < head->count; i++) {
 		if (!PAGE_ALIGNED(list[i].offset))
 			goto err;
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 888aadb6a4acb..d6550b54fac16 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -860,11 +860,23 @@ void drm_framebuffer_free(struct kref *kref)
 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 			 const struct drm_framebuffer_funcs *funcs)
 {
+	unsigned int i;
 	int ret;
+	bool exists;
 
 	if (WARN_ON_ONCE(fb->dev != dev || !fb->format))
 		return -EINVAL;
 
+	for (i = 0; i < fb->format->num_planes; i++) {
+		if (drm_WARN_ON_ONCE(dev, fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)))
+			fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
+		if (fb->obj[i]) {
+			exists = drm_gem_object_handle_get_if_exists_unlocked(fb->obj[i]);
+			if (exists)
+				fb->internal_flags |= DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
+		}
+	}
+
 	INIT_LIST_HEAD(&fb->filp_head);
 
 	fb->funcs = funcs;
@@ -873,7 +885,7 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 	ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB,
 				    false, drm_framebuffer_free);
 	if (ret)
-		goto out;
+		goto err;
 
 	mutex_lock(&dev->mode_config.fb_lock);
 	dev->mode_config.num_fb++;
@@ -881,7 +893,16 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 	mutex_unlock(&dev->mode_config.fb_lock);
 
 	drm_mode_object_register(dev, &fb->base);
-out:
+
+	return 0;
+
+err:
+	for (i = 0; i < fb->format->num_planes; i++) {
+		if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) {
+			drm_gem_object_handle_put_unlocked(fb->obj[i]);
+			fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
+		}
+	}
 	return ret;
 }
 EXPORT_SYMBOL(drm_framebuffer_init);
@@ -958,6 +979,12 @@ EXPORT_SYMBOL(drm_framebuffer_unregister_private);
 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
 	struct drm_device *dev = fb->dev;
+	unsigned int i;
+
+	for (i = 0; i < fb->format->num_planes; i++) {
+		if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i))
+			drm_gem_object_handle_put_unlocked(fb->obj[i]);
+	}
 
 	mutex_lock(&dev->mode_config.fb_lock);
 	list_del(&fb->head);
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 149b8e25da5bb..ae9e671bfc95c 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -186,6 +186,46 @@ void drm_gem_private_object_fini(struct drm_gem_object *obj)
 }
 EXPORT_SYMBOL(drm_gem_private_object_fini);
 
+static void drm_gem_object_handle_get(struct drm_gem_object *obj)
+{
+	struct drm_device *dev = obj->dev;
+
+	drm_WARN_ON(dev, !mutex_is_locked(&dev->object_name_lock));
+
+	if (obj->handle_count++ == 0)
+		drm_gem_object_get(obj);
+}
+
+/**
+ * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
+ * @obj: GEM object
+ *
+ * Acquires a reference on the GEM buffer object's handle. Required to keep
+ * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
+ * to release the reference. Does nothing if the buffer object has no handle.
+ *
+ * Returns:
+ * True if a handle exists, or false otherwise
+ */
+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
+{
+	struct drm_device *dev = obj->dev;
+
+	guard(mutex)(&dev->object_name_lock);
+
+	/*
+	 * First ref taken during GEM object creation, if any. Some
+	 * drivers set up internal framebuffers with GEM objects that
+	 * do not have a GEM handle. Hence, this counter can be zero.
+	 */
+	if (!obj->handle_count)
+		return false;
+
+	drm_gem_object_handle_get(obj);
+
+	return true;
+}
+
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles
  * @obj: GEM object to clean up.
@@ -216,20 +256,26 @@ static void drm_gem_object_exported_dma_buf_free(struct drm_gem_object *obj)
 	}
 }
 
-static void
-drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj)
+/**
+ * drm_gem_object_handle_put_unlocked - releases reference on user-space handle
+ * @obj: GEM object
+ *
+ * Releases a reference on the GEM buffer object's handle. Possibly releases
+ * the GEM buffer object and associated dma-buf objects.
+ */
+void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 	bool final = false;
 
-	if (WARN_ON(READ_ONCE(obj->handle_count) == 0))
+	if (drm_WARN_ON(dev, READ_ONCE(obj->handle_count) == 0))
 		return;
 
 	/*
-	* Must bump handle count first as this may be the last
-	* ref, in which case the object would disappear before we
-	* checked for a name
-	*/
+	 * Must bump handle count first as this may be the last
+	 * ref, in which case the object would disappear before
+	 * we checked for a name.
+	 */
 
 	mutex_lock(&dev->object_name_lock);
 	if (--obj->handle_count == 0) {
@@ -363,8 +409,8 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
 	int ret;
 
 	WARN_ON(!mutex_is_locked(&dev->object_name_lock));
-	if (obj->handle_count++ == 0)
-		drm_gem_object_get(obj);
+
+	drm_gem_object_handle_get(obj);
 
 	/*
 	 * Get the user-visible handle using idr.  Preload and perform
diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h
index 1705bfc90b1e7..98b73c581c426 100644
--- a/drivers/gpu/drm/drm_internal.h
+++ b/drivers/gpu/drm/drm_internal.h
@@ -153,6 +153,8 @@ void drm_sysfs_lease_event(struct drm_device *dev);
 
 /* drm_gem.c */
 int drm_gem_init(struct drm_device *dev);
+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj);
+void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj);
 int drm_gem_handle_create_tail(struct drm_file *file_priv,
 			       struct drm_gem_object *obj,
 			       u32 *handlep);
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 0c1a713b7b7b3..be642ee739c4f 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -245,17 +245,19 @@ static int __init vkms_init(void)
 	if (!config)
 		return -ENOMEM;
 
-	default_config = config;
-
 	config->cursor = enable_cursor;
 	config->writeback = enable_writeback;
 	config->overlay = enable_overlay;
 
 	ret = vkms_create(config);
-	if (ret)
+	if (ret) {
 		kfree(config);
+		return ret;
+	}
 
-	return ret;
+	default_config = config;
+
+	return 0;
 }
 
 static void vkms_destroy(struct vkms_config *config)
@@ -279,9 +281,10 @@ static void vkms_destroy(struct vkms_config *config)
 
 static void __exit vkms_exit(void)
 {
-	if (default_config->dev)
-		vkms_destroy(default_config);
+	if (!default_config)
+		return;
 
+	vkms_destroy(default_config);
 	kfree(default_config);
 }
 
diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index a96976b22fa79..a6277c0cd9c5d 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -124,15 +124,19 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer,
 	struct bio *bio = NULL;
 	int ret;
 
-	if (has_metadata && !supports_metadata)
-		return -EINVAL;
+	if (has_metadata && !supports_metadata) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	if (ioucmd && (ioucmd->flags & IORING_URING_CMD_FIXED)) {
 		struct iov_iter iter;
 
 		/* fixedbufs is only for non-vectored io */
-		if (WARN_ON_ONCE(flags & NVME_IOCTL_VEC))
-			return -EINVAL;
+		if (flags & NVME_IOCTL_VEC) {
+			ret = -EINVAL;
+			goto out;
+		}
 		ret = io_uring_cmd_import_fixed(ubuffer, bufflen,
 				rq_data_dir(req), &iter, ioucmd);
 		if (ret < 0)
diff --git a/include/drm/drm_framebuffer.h b/include/drm/drm_framebuffer.h
index 668077009fced..38b24fc8978d3 100644
--- a/include/drm/drm_framebuffer.h
+++ b/include/drm/drm_framebuffer.h
@@ -23,6 +23,7 @@
 #ifndef __DRM_FRAMEBUFFER_H__
 #define __DRM_FRAMEBUFFER_H__
 
+#include <linux/bits.h>
 #include <linux/ctype.h>
 #include <linux/list.h>
 #include <linux/sched.h>
@@ -100,6 +101,8 @@ struct drm_framebuffer_funcs {
 		     unsigned num_clips);
 };
 
+#define DRM_FRAMEBUFFER_HAS_HANDLE_REF(_i)	BIT(0u + (_i))
+
 /**
  * struct drm_framebuffer - frame buffer object
  *
@@ -188,6 +191,10 @@ struct drm_framebuffer {
 	 * DRM_MODE_FB_MODIFIERS.
 	 */
 	int flags;
+	/**
+	 * @internal_flags: Framebuffer flags like DRM_FRAMEBUFFER_HAS_HANDLE_REF.
+	 */
+	unsigned int internal_flags;
 	/**
 	 * @filp_head: Placed on &drm_file.fbs, protected by &drm_file.fbs_lock.
 	 */
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fadf6ab9646c9..2d2bfd3963c7b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -689,21 +689,16 @@ u64 avg_vruntime(struct cfs_rq *cfs_rq)
  *
  * XXX could add max_slice to the augmented data to track this.
  */
-static s64 entity_lag(u64 avruntime, struct sched_entity *se)
+static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
 	s64 vlag, limit;
 
-	vlag = avruntime - se->vruntime;
-	limit = calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se);
-
-	return clamp(vlag, -limit, limit);
-}
-
-static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
-{
 	SCHED_WARN_ON(!se->on_rq);
 
-	se->vlag = entity_lag(avg_vruntime(cfs_rq), se);
+	vlag = avg_vruntime(cfs_rq) - se->vruntime;
+	limit = calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se);
+
+	se->vlag = clamp(vlag, -limit, limit);
 }
 
 /*
@@ -3774,137 +3769,33 @@ static inline void
 dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { }
 #endif
 
-static void reweight_eevdf(struct sched_entity *se, u64 avruntime,
-			   unsigned long weight)
-{
-	unsigned long old_weight = se->load.weight;
-	s64 vlag, vslice;
-
-	/*
-	 * VRUNTIME
-	 * --------
-	 *
-	 * COROLLARY #1: The virtual runtime of the entity needs to be
-	 * adjusted if re-weight at !0-lag point.
-	 *
-	 * Proof: For contradiction assume this is not true, so we can
-	 * re-weight without changing vruntime at !0-lag point.
-	 *
-	 *             Weight	VRuntime   Avg-VRuntime
-	 *     before    w          v            V
-	 *      after    w'         v'           V'
-	 *
-	 * Since lag needs to be preserved through re-weight:
-	 *
-	 *	lag = (V - v)*w = (V'- v')*w', where v = v'
-	 *	==>	V' = (V - v)*w/w' + v		(1)
-	 *
-	 * Let W be the total weight of the entities before reweight,
-	 * since V' is the new weighted average of entities:
-	 *
-	 *	V' = (WV + w'v - wv) / (W + w' - w)	(2)
-	 *
-	 * by using (1) & (2) we obtain:
-	 *
-	 *	(WV + w'v - wv) / (W + w' - w) = (V - v)*w/w' + v
-	 *	==> (WV-Wv+Wv+w'v-wv)/(W+w'-w) = (V - v)*w/w' + v
-	 *	==> (WV - Wv)/(W + w' - w) + v = (V - v)*w/w' + v
-	 *	==>	(V - v)*W/(W + w' - w) = (V - v)*w/w' (3)
-	 *
-	 * Since we are doing at !0-lag point which means V != v, we
-	 * can simplify (3):
-	 *
-	 *	==>	W / (W + w' - w) = w / w'
-	 *	==>	Ww' = Ww + ww' - ww
-	 *	==>	W * (w' - w) = w * (w' - w)
-	 *	==>	W = w	(re-weight indicates w' != w)
-	 *
-	 * So the cfs_rq contains only one entity, hence vruntime of
-	 * the entity @v should always equal to the cfs_rq's weighted
-	 * average vruntime @V, which means we will always re-weight
-	 * at 0-lag point, thus breach assumption. Proof completed.
-	 *
-	 *
-	 * COROLLARY #2: Re-weight does NOT affect weighted average
-	 * vruntime of all the entities.
-	 *
-	 * Proof: According to corollary #1, Eq. (1) should be:
-	 *
-	 *	(V - v)*w = (V' - v')*w'
-	 *	==>    v' = V' - (V - v)*w/w'		(4)
-	 *
-	 * According to the weighted average formula, we have:
-	 *
-	 *	V' = (WV - wv + w'v') / (W - w + w')
-	 *	   = (WV - wv + w'(V' - (V - v)w/w')) / (W - w + w')
-	 *	   = (WV - wv + w'V' - Vw + wv) / (W - w + w')
-	 *	   = (WV + w'V' - Vw) / (W - w + w')
-	 *
-	 *	==>  V'*(W - w + w') = WV + w'V' - Vw
-	 *	==>	V' * (W - w) = (W - w) * V	(5)
-	 *
-	 * If the entity is the only one in the cfs_rq, then reweight
-	 * always occurs at 0-lag point, so V won't change. Or else
-	 * there are other entities, hence W != w, then Eq. (5) turns
-	 * into V' = V. So V won't change in either case, proof done.
-	 *
-	 *
-	 * So according to corollary #1 & #2, the effect of re-weight
-	 * on vruntime should be:
-	 *
-	 *	v' = V' - (V - v) * w / w'		(4)
-	 *	   = V  - (V - v) * w / w'
-	 *	   = V  - vl * w / w'
-	 *	   = V  - vl'
-	 */
-	if (avruntime != se->vruntime) {
-		vlag = entity_lag(avruntime, se);
-		vlag = div_s64(vlag * old_weight, weight);
-		se->vruntime = avruntime - vlag;
-	}
-
-	/*
-	 * DEADLINE
-	 * --------
-	 *
-	 * When the weight changes, the virtual time slope changes and
-	 * we should adjust the relative virtual deadline accordingly.
-	 *
-	 *	d' = v' + (d - v)*w/w'
-	 *	   = V' - (V - v)*w/w' + (d - v)*w/w'
-	 *	   = V  - (V - v)*w/w' + (d - v)*w/w'
-	 *	   = V  + (d - V)*w/w'
-	 */
-	vslice = (s64)(se->deadline - avruntime);
-	vslice = div_s64(vslice * old_weight, weight);
-	se->deadline = avruntime + vslice;
-}
+static void place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags);
 
 static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
 			    unsigned long weight)
 {
 	bool curr = cfs_rq->curr == se;
-	u64 avruntime;
 
 	if (se->on_rq) {
 		/* commit outstanding execution time */
 		update_curr(cfs_rq);
-		avruntime = avg_vruntime(cfs_rq);
+		update_entity_lag(cfs_rq, se);
+		se->deadline -= se->vruntime;
+		se->rel_deadline = 1;
+		cfs_rq->nr_running--;
 		if (!curr)
 			__dequeue_entity(cfs_rq, se);
 		update_load_sub(&cfs_rq->load, se->load.weight);
 	}
 	dequeue_load_avg(cfs_rq, se);
 
-	if (se->on_rq) {
-		reweight_eevdf(se, avruntime, weight);
-	} else {
-		/*
-		 * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i),
-		 * we need to scale se->vlag when w_i changes.
-		 */
-		se->vlag = div_s64(se->vlag * se->load.weight, weight);
-	}
+	/*
+	 * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i),
+	 * we need to scale se->vlag when w_i changes.
+	 */
+	se->vlag = div_s64(se->vlag * se->load.weight, weight);
+	if (se->rel_deadline)
+		se->deadline = div_s64(se->deadline * se->load.weight, weight);
 
 	update_load_set(&se->load, weight);
 
@@ -3918,9 +3809,11 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
 
 	enqueue_load_avg(cfs_rq, se);
 	if (se->on_rq) {
+		place_entity(cfs_rq, se, 0);
 		update_load_add(&cfs_rq->load, se->load.weight);
 		if (!curr)
 			__enqueue_entity(cfs_rq, se);
+		cfs_rq->nr_running++;
 
 		/*
 		 * The entity's vruntime has been adjusted, so let's check
@@ -4065,7 +3958,11 @@ static void update_cfs_group(struct sched_entity *se)
 	struct cfs_rq *gcfs_rq = group_cfs_rq(se);
 	long shares;
 
-	if (!gcfs_rq)
+	/*
+	 * When a group becomes empty, preserve its weight. This matters for
+	 * DELAY_DEQUEUE.
+	 */
+	if (!gcfs_rq || !gcfs_rq->load.weight)
 		return;
 
 	if (throttled_hierarchy(gcfs_rq))
@@ -5291,7 +5188,7 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
 	 *
 	 * EEVDF: placement strategy #1 / #2
 	 */
-	if (sched_feat(PLACE_LAG) && cfs_rq->nr_running) {
+	if (sched_feat(PLACE_LAG) && cfs_rq->nr_running && se->vlag) {
 		struct sched_entity *curr = cfs_rq->curr;
 		unsigned long load;
 
@@ -5361,7 +5258,7 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
 
 	se->vruntime = vruntime - lag;
 
-	if (sched_feat(PLACE_REL_DEADLINE) && se->rel_deadline) {
+	if (se->rel_deadline) {
 		se->deadline += se->vruntime;
 		se->rel_deadline = 0;
 		return;
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 6bcee47040592..d44641108ba81 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1400,6 +1400,15 @@ void run_posix_cpu_timers(void)
 
 	lockdep_assert_irqs_disabled();
 
+	/*
+	 * Ensure that release_task(tsk) can't happen while
+	 * handle_posix_cpu_timers() is running. Otherwise, a concurrent
+	 * posix_cpu_timer_del() may fail to lock_task_sighand(tsk) and
+	 * miss timer->it.cpu.firing != 0.
+	 */
+	if (tsk->exit_state)
+		return;
+
 	/*
 	 * If the actual expiry is deferred to task work context and the
 	 * work is already scheduled there is no point to do anything here.
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index fe77c3b0add3f..a3b1c212ace3c 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -784,15 +784,12 @@ static u32 qdisc_alloc_handle(struct net_device *dev)
 
 void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
 {
-	bool qdisc_is_offloaded = sch->flags & TCQ_F_OFFLOADED;
 	const struct Qdisc_class_ops *cops;
 	unsigned long cl;
 	u32 parentid;
 	bool notify;
 	int drops;
 
-	if (n == 0 && len == 0)
-		return;
 	drops = max_t(int, n, 0);
 	rcu_read_lock();
 	while ((parentid = sch->parent)) {
@@ -801,17 +798,8 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
 
 		if (sch->flags & TCQ_F_NOPARENT)
 			break;
-		/* Notify parent qdisc only if child qdisc becomes empty.
-		 *
-		 * If child was empty even before update then backlog
-		 * counter is screwed and we skip notification because
-		 * parent class is already passive.
-		 *
-		 * If the original child was offloaded then it is allowed
-		 * to be seem as empty, so the parent is notified anyway.
-		 */
-		notify = !sch->q.qlen && !WARN_ON_ONCE(!n &&
-						       !qdisc_is_offloaded);
+		/* Notify parent qdisc only if child qdisc becomes empty. */
+		notify = !sch->q.qlen;
 		/* TODO: perform the search on a per txq basis */
 		sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid));
 		if (sch == NULL) {
@@ -820,6 +808,9 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
 		}
 		cops = sch->ops->cl_ops;
 		if (notify && cops->qlen_notify) {
+			/* Note that qlen_notify must be idempotent as it may get called
+			 * multiple times.
+			 */
 			cl = cops->find(sch, parentid);
 			cops->qlen_notify(sch, cl);
 		}
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 3e8d4fe4d91e3..e1f6e7618debd 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -65,10 +65,7 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
 			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
 			    drop_func, dequeue_func);
 
-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
-	 * or HTB crashes. Defer it for next round.
-	 */
-	if (q->stats.drop_count && sch->q.qlen) {
+	if (q->stats.drop_count) {
 		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
 		q->stats.drop_count = 0;
 		q->stats.drop_len = 0;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index c69b999fae171..e0a81d313aa76 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -105,6 +105,7 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 		return -ENOBUFS;
 
 	gnet_stats_basic_sync_init(&cl->bstats);
+	INIT_LIST_HEAD(&cl->alist);
 	cl->common.classid = classid;
 	cl->quantum	   = quantum;
 	cl->qdisc	   = qdisc_create_dflt(sch->dev_queue,
@@ -229,7 +230,7 @@ static void drr_qlen_notify(struct Qdisc *csh, unsigned long arg)
 {
 	struct drr_class *cl = (struct drr_class *)arg;
 
-	list_del(&cl->alist);
+	list_del_init(&cl->alist);
 }
 
 static int drr_dump_class(struct Qdisc *sch, unsigned long arg,
@@ -390,7 +391,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
 			if (unlikely(skb == NULL))
 				goto out;
 			if (cl->qdisc->q.qlen == 0)
-				list_del(&cl->alist);
+				list_del_init(&cl->alist);
 
 			bstats_update(&cl->bstats, skb);
 			qdisc_bstats_update(sch, skb);
@@ -431,7 +432,7 @@ static void drr_reset_qdisc(struct Qdisc *sch)
 	for (i = 0; i < q->clhash.hashsize; i++) {
 		hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
 			if (cl->qdisc->q.qlen)
-				list_del(&cl->alist);
+				list_del_init(&cl->alist);
 			qdisc_reset(cl->qdisc);
 		}
 	}
diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
index cc9baa719cf4d..1ca098bf64ac6 100644
--- a/net/sched/sch_ets.c
+++ b/net/sched/sch_ets.c
@@ -649,6 +649,12 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
 
 	sch_tree_lock(sch);
 
+	for (i = nbands; i < oldbands; i++) {
+		if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
+			list_del_init(&q->classes[i].alist);
+		qdisc_purge_queue(q->classes[i].qdisc);
+	}
+
 	WRITE_ONCE(q->nbands, nbands);
 	for (i = nstrict; i < q->nstrict; i++) {
 		if (q->classes[i].qdisc->q.qlen) {
@@ -656,11 +662,6 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
 			q->classes[i].deficit = quanta[i];
 		}
 	}
-	for (i = q->nbands; i < oldbands; i++) {
-		if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
-			list_del_init(&q->classes[i].alist);
-		qdisc_tree_flush_backlog(q->classes[i].qdisc);
-	}
 	WRITE_ONCE(q->nstrict, nstrict);
 	memcpy(q->prio2band, priomap, sizeof(priomap));
 
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 4f908c11ba952..778f6e5966be8 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -314,10 +314,8 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
 	}
 	qdisc_bstats_update(sch, skb);
 	flow->deficit -= qdisc_pkt_len(skb);
-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
-	 * or HTB crashes. Defer it for next round.
-	 */
-	if (q->cstats.drop_count && sch->q.qlen) {
+
+	if (q->cstats.drop_count) {
 		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
 					  q->cstats.drop_len);
 		q->cstats.drop_count = 0;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index ff3de37874e4b..b2494d24a5425 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -348,7 +348,8 @@ static void htb_add_to_wait_tree(struct htb_sched *q,
  */
 static inline void htb_next_rb_node(struct rb_node **n)
 {
-	*n = rb_next(*n);
+	if (*n)
+		*n = rb_next(*n);
 }
 
 /**
@@ -609,8 +610,8 @@ static inline void htb_activate(struct htb_sched *q, struct htb_class *cl)
  */
 static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl)
 {
-	WARN_ON(!cl->prio_activity);
-
+	if (!cl->prio_activity)
+		return;
 	htb_deactivate_prios(q, cl);
 	cl->prio_activity = 0;
 }
@@ -1738,8 +1739,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg,
 	if (cl->parent)
 		cl->parent->children--;
 
-	if (cl->prio_activity)
-		htb_deactivate(q, cl);
+	htb_deactivate(q, cl);
 
 	if (cl->cmode != HTB_CAN_SEND)
 		htb_safe_rb_erase(&cl->pq_node,
@@ -1947,8 +1947,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
 			/* turn parent into inner node */
 			qdisc_purge_queue(parent->leaf.q);
 			parent_qdisc = parent->leaf.q;
-			if (parent->prio_activity)
-				htb_deactivate(q, parent);
+			htb_deactivate(q, parent);
 
 			/* remove from evt list because of level change */
 			if (parent->cmode != HTB_CAN_SEND) {
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index d584c0c25899c..d1e6f9fcc0990 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -347,7 +347,7 @@ static void qfq_deactivate_class(struct qfq_sched *q, struct qfq_class *cl)
 	struct qfq_aggregate *agg = cl->agg;
 
 
-	list_del(&cl->alist); /* remove from RR queue of the aggregate */
+	list_del_init(&cl->alist); /* remove from RR queue of the aggregate */
 	if (list_empty(&agg->active)) /* agg is now inactive */
 		qfq_deactivate_agg(q, agg);
 }
@@ -477,6 +477,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 	gnet_stats_basic_sync_init(&cl->bstats);
 	cl->common.classid = classid;
 	cl->deficit = lmax;
+	INIT_LIST_HEAD(&cl->alist);
 
 	cl->qdisc = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
 				      classid, NULL);
@@ -985,7 +986,7 @@ static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
 	cl->deficit -= (int) len;
 
 	if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
-		list_del(&cl->alist);
+		list_del_init(&cl->alist);
 	else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {
 		cl->deficit += agg->lmax;
 		list_move_tail(&cl->alist, &agg->active);
@@ -1418,6 +1419,8 @@ static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
 	struct qfq_sched *q = qdisc_priv(sch);
 	struct qfq_class *cl = (struct qfq_class *)arg;
 
+	if (list_empty(&cl->alist))
+		return;
 	qfq_deactivate_class(q, cl);
 }
 
diff --git a/redhat/Makefile.variables b/redhat/Makefile.variables
index 3fe3656fcddf4..c8bcbec2c9963 100644
--- a/redhat/Makefile.variables
+++ b/redhat/Makefile.variables
@@ -142,7 +142,7 @@ SPECPACKAGE_NAME ?= kernel
 # should be tracked in a local branch. This would be "master" for the
 # Linus master branch or linux-5.x.y for a stable branch. It can also be
 # any other upstream you have added as a branch locally.
-UPSTREAM_BRANCH ?= v6.10
+UPSTREAM_BRANCH ?= v6.12
 
 # If VERSION_ON_UPSTREAM is set, the versioning of the rpm package is based
 # on a branch tracking upstream. This allows for generating rpms
diff --git a/redhat/kernel.changelog-10.0 b/redhat/kernel.changelog-10.0
index 475cb89311137..26b686eb18f02 100644
--- a/redhat/kernel.changelog-10.0
+++ b/redhat/kernel.changelog-10.0
@@ -1,3 +1,29 @@
+* Tue Sep 09 2025 Jan Stancek <jstancek@redhat.com> [6.12.0-55.32.1.el10_0]
+- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112784] {CVE-2025-38352}
+Resolves: RHEL-112784
+
+* Sun Aug 31 2025 Jan Stancek <jstancek@redhat.com> [6.12.0-55.31.1.el10_0]
+- sched/fair: Adhere to place_entity() constraints (Phil Auld) [RHEL-91404]
+- sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE (Phil Auld) [RHEL-91404]
+- sched/fair: Fix EEVDF entity placement bug causing scheduling lag (Phil Auld) [RHEL-91404]
+- sched/fair: optimize the PLACE_LAG when se->vlag is zero (Phil Auld) [RHEL-91404]
+- net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107544] {CVE-2025-38350}
+- net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
+- net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107544] {CVE-2025-38107}
+- sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-37953}
+- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93365] {CVE-2025-37798}
+- sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
+- sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
+- sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-37932}
+- drm/vkms: Fix use after free and double free on init error (Jocelyn Falempe) [RHEL-99432] {CVE-2025-22097}
+- Revert "cxl/acpi: Fix load failures due to single window creation failure" (John W. Linville) [RHEL-85055]
+- udmabuf: fix a buf size overflow issue during udmabuf creation (Lyude Paul) [RHEL-99760] {CVE-2025-37803}
+- drm/framebuffer: Acquire internal references on GEM handles (Mika Penttilä) [RHEL-106710] {CVE-2025-38449}
+- drm/gem: Acquire references on GEM handles for framebuffers (Mika Penttilä) [RHEL-106710] {CVE-2025-38449}
+- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Maurizio Lombardi) [RHEL-109753]
+- nvme-ioctl: fix leaked requests on mapping error (Maurizio Lombardi) [RHEL-109753]
+Resolves: RHEL-106710, RHEL-107544, RHEL-109753, RHEL-85055, RHEL-91404, RHEL-93365, RHEL-99432, RHEL-99760
+
 * Sun Aug 24 2025 Jan Stancek <jstancek@redhat.com> [6.12.0-55.30.1.el10_0]
 - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-107641] {CVE-2025-37823}
 - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-95537]
diff --git a/redhat/self-test/data/centos-2585cf9dfaad.el7 b/redhat/self-test/data/centos-2585cf9dfaad.el7
index 782f1ac714fb2..50163053bb608 100644
--- a/redhat/self-test/data/centos-2585cf9dfaad.el7
+++ b/redhat/self-test/data/centos-2585cf9dfaad.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-2585cf9dfaad.fc25 b/redhat/self-test/data/centos-2585cf9dfaad.fc25
index 629aaa270fc81..8bbbc9cad13ab 100644
--- a/redhat/self-test/data/centos-2585cf9dfaad.fc25
+++ b/redhat/self-test/data/centos-2585cf9dfaad.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-78e36f3b0dae.el7 b/redhat/self-test/data/centos-78e36f3b0dae.el7
index 44907ead56a6e..e3e414f803b70 100644
--- a/redhat/self-test/data/centos-78e36f3b0dae.el7
+++ b/redhat/self-test/data/centos-78e36f3b0dae.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-78e36f3b0dae.fc25 b/redhat/self-test/data/centos-78e36f3b0dae.fc25
index a9af598464bb5..edf30be4a41dd 100644
--- a/redhat/self-test/data/centos-78e36f3b0dae.fc25
+++ b/redhat/self-test/data/centos-78e36f3b0dae.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-df0cc57e057f.el7 b/redhat/self-test/data/centos-df0cc57e057f.el7
index 2d2d13009cf18..cb58144cf51e0 100644
--- a/redhat/self-test/data/centos-df0cc57e057f.el7
+++ b/redhat/self-test/data/centos-df0cc57e057f.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-df0cc57e057f.fc25 b/redhat/self-test/data/centos-df0cc57e057f.fc25
index 4d07a6f32c17c..2093c25c5e71a 100644
--- a/redhat/self-test/data/centos-df0cc57e057f.fc25
+++ b/redhat/self-test/data/centos-df0cc57e057f.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-fce15c45d3fb.el7 b/redhat/self-test/data/centos-fce15c45d3fb.el7
index 9df48c9b326b4..90af863b0e736 100644
--- a/redhat/self-test/data/centos-fce15c45d3fb.el7
+++ b/redhat/self-test/data/centos-fce15c45d3fb.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/centos-fce15c45d3fb.fc25 b/redhat/self-test/data/centos-fce15c45d3fb.fc25
index 5189915e6a856..2c9a3ad4222a9 100644
--- a/redhat/self-test/data/centos-fce15c45d3fb.fc25
+++ b/redhat/self-test/data/centos-fce15c45d3fb.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-2585cf9dfaad.el7 b/redhat/self-test/data/fedora-2585cf9dfaad.el7
index f76fe0521cce3..bed36ddea3c80 100644
--- a/redhat/self-test/data/fedora-2585cf9dfaad.el7
+++ b/redhat/self-test/data/fedora-2585cf9dfaad.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-2585cf9dfaad.fc25 b/redhat/self-test/data/fedora-2585cf9dfaad.fc25
index ad3708426c1c4..6a3fd2385e9f2 100644
--- a/redhat/self-test/data/fedora-2585cf9dfaad.fc25
+++ b/redhat/self-test/data/fedora-2585cf9dfaad.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-78e36f3b0dae.el7 b/redhat/self-test/data/fedora-78e36f3b0dae.el7
index 701b9d0fc5672..a0ca8af46c6b1 100644
--- a/redhat/self-test/data/fedora-78e36f3b0dae.el7
+++ b/redhat/self-test/data/fedora-78e36f3b0dae.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-78e36f3b0dae.fc25 b/redhat/self-test/data/fedora-78e36f3b0dae.fc25
index 333b55f864453..2175356a3af87 100644
--- a/redhat/self-test/data/fedora-78e36f3b0dae.fc25
+++ b/redhat/self-test/data/fedora-78e36f3b0dae.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-df0cc57e057f.el7 b/redhat/self-test/data/fedora-df0cc57e057f.el7
index 07591b83b3828..17c2e91772e77 100644
--- a/redhat/self-test/data/fedora-df0cc57e057f.el7
+++ b/redhat/self-test/data/fedora-df0cc57e057f.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-df0cc57e057f.fc25 b/redhat/self-test/data/fedora-df0cc57e057f.fc25
index 4cbf148cc10ca..b5fdba2e7a253 100644
--- a/redhat/self-test/data/fedora-df0cc57e057f.fc25
+++ b/redhat/self-test/data/fedora-df0cc57e057f.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-fce15c45d3fb.el7 b/redhat/self-test/data/fedora-fce15c45d3fb.el7
index bdd9c77c9368f..e99fbb5f9ae81 100644
--- a/redhat/self-test/data/fedora-fce15c45d3fb.el7
+++ b/redhat/self-test/data/fedora-fce15c45d3fb.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/fedora-fce15c45d3fb.fc25 b/redhat/self-test/data/fedora-fce15c45d3fb.fc25
index d444bba38a11d..b8949643d63c9 100644
--- a/redhat/self-test/data/fedora-fce15c45d3fb.fc25
+++ b/redhat/self-test/data/fedora-fce15c45d3fb.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-2585cf9dfaad.el7 b/redhat/self-test/data/rhel-2585cf9dfaad.el7
index c553d388437d3..f619d38241621 100644
--- a/redhat/self-test/data/rhel-2585cf9dfaad.el7
+++ b/redhat/self-test/data/rhel-2585cf9dfaad.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-2585cf9dfaad.fc25 b/redhat/self-test/data/rhel-2585cf9dfaad.fc25
index 919dae09b30bd..edfcfe32c5e31 100644
--- a/redhat/self-test/data/rhel-2585cf9dfaad.fc25
+++ b/redhat/self-test/data/rhel-2585cf9dfaad.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-78e36f3b0dae.el7 b/redhat/self-test/data/rhel-78e36f3b0dae.el7
index b0548d568fe7d..a95499310d4fe 100644
--- a/redhat/self-test/data/rhel-78e36f3b0dae.el7
+++ b/redhat/self-test/data/rhel-78e36f3b0dae.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-78e36f3b0dae.fc25 b/redhat/self-test/data/rhel-78e36f3b0dae.fc25
index 72776c573a32c..9960ae9a54974 100644
--- a/redhat/self-test/data/rhel-78e36f3b0dae.fc25
+++ b/redhat/self-test/data/rhel-78e36f3b0dae.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-df0cc57e057f.el7 b/redhat/self-test/data/rhel-df0cc57e057f.el7
index 0ca23eb9d9fff..fc852d2cbf239 100644
--- a/redhat/self-test/data/rhel-df0cc57e057f.el7
+++ b/redhat/self-test/data/rhel-df0cc57e057f.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-df0cc57e057f.fc25 b/redhat/self-test/data/rhel-df0cc57e057f.fc25
index d7f5adccdeca1..6d0189d9ea3ba 100644
--- a/redhat/self-test/data/rhel-df0cc57e057f.fc25
+++ b/redhat/self-test/data/rhel-df0cc57e057f.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-fce15c45d3fb.el7 b/redhat/self-test/data/rhel-fce15c45d3fb.el7
index c867d495cf390..0d8a6b6fd0eee 100644
--- a/redhat/self-test/data/rhel-fce15c45d3fb.el7
+++ b/redhat/self-test/data/rhel-fce15c45d3fb.el7
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no
diff --git a/redhat/self-test/data/rhel-fce15c45d3fb.fc25 b/redhat/self-test/data/rhel-fce15c45d3fb.fc25
index 3e8ad8742c4be..cf6bd9917f370 100644
--- a/redhat/self-test/data/rhel-fce15c45d3fb.fc25
+++ b/redhat/self-test/data/rhel-fce15c45d3fb.fc25
@@ -97,7 +97,7 @@ TESTPATCH=../redhat/linux-kernel-test.patch
 TOPDIR=..
 UPSTREAMBUILD=0.rc5.
 UPSTREAMBUILD_GIT_ONLY=
-UPSTREAM_BRANCH=v6.10
+UPSTREAM_BRANCH=v6.12
 UPSTREAM_TARBALL_NAME=5.16-rc5
 VERSION_ON_UPSTREAM=0
 YSTREAM_FLAG=no