diff --git a/my-ostree-os/kernel/Makefile.rhelver b/my-ostree-os/kernel/Makefile.rhelver
index ed5527e..76c6c89 100644
--- a/my-ostree-os/kernel/Makefile.rhelver
+++ b/my-ostree-os/kernel/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 1
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 124.20.1
+RHEL_RELEASE = 124.21.1
 
 #
 # RHEL_REBASE_NUM
diff --git a/my-ostree-os/kernel/kernel.changelog b/my-ostree-os/kernel/kernel.changelog
index 093ba77..4e00b19 100644
--- a/my-ostree-os/kernel/kernel.changelog
+++ b/my-ostree-os/kernel/kernel.changelog
@@ -1,3 +1,8 @@
+* Thu Dec 04 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.21.1.el10_1]
+- CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129282] {CVE-2025-38499}
+- net: tun: Update napi->skb after XDP process (CKI Backport Bot) [RHEL-122247] {CVE-2025-39984}
+Resolves: RHEL-122247, RHEL-129282
+
 * Tue Dec 02 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.20.1.el10_1]
 - iommu/vt-d: Disallow dirty tracking if incoherent page walk (CKI Backport Bot) [RHEL-125482] {CVE-2025-40058}
 - net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124432] {CVE-2025-39979}
diff --git a/my-ostree-os/kernel/kernel.spec b/my-ostree-os/kernel/kernel.spec
index e5af00b..54cdf89 100644
--- a/my-ostree-os/kernel/kernel.spec
+++ b/my-ostree-os/kernel/kernel.spec
@@ -176,15 +176,15 @@ Summary: The Linux kernel
 %define specrpmversion 6.12.0
 %define specversion 6.12.0
 %define patchversion 6.12
-%define pkgrelease 124.20.1
+%define pkgrelease 124.21.1
 %define kversion 6
-%define tarfile_release 6.12.0-124.20.1.el10_1
+%define tarfile_release 6.12.0-124.21.1.el10_1
 # This is needed to do merge window version magic
 %define patchlevel 12
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 124.20.1%{?buildid}%{?dist}
+%define specrelease 124.21.1%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 6.12.0-124.20.1.el10_1
+%define kabiversion 6.12.0-124.21.1.el10_1
 
 # If this variable is set to 1, a bpf selftests build failure will cause a
 # fatal kernel package build error
@@ -4403,14 +4403,14 @@ fi\
 #
 #
 %changelog
-* Tue Dec 09 2025 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-124.20.1
+* Mon Dec 22 2025 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-124.21.1
 - Debrand for AlmaLinux OS
 - Use AlmaLinux OS secure boot cert
 
-* Tue Dec 09 2025 Neal Gompa <ngompa@almalinux.org> - 6.12.0-124.20.1
+* Mon Dec 22 2025 Neal Gompa <ngompa@almalinux.org> - 6.12.0-124.21.1
 - Enable Btrfs support for all kernel variants
 
-* Tue Dec 09 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.20.1
+* Mon Dec 22 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.21.1
 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
@@ -4421,6 +4421,10 @@ fi\
 - kernel/rh_messages.h: enable all disabled pci devices by moving to
   unmaintained
 
+* Thu Dec 04 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.21.1.el10_1]
+- CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129282] {CVE-2025-38499}
+- net: tun: Update napi->skb after XDP process (CKI Backport Bot) [RHEL-122247] {CVE-2025-39984}
+
 * Tue Dec 02 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.20.1.el10_1]
 - iommu/vt-d: Disallow dirty tracking if incoherent page walk (CKI Backport Bot) [RHEL-125482] {CVE-2025-40058}
 - net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124432] {CVE-2025-39979}