diff --git a/SOURCES/Makefile.common b/SOURCES/Makefile.common
index a089ccd..bc5a495 100644
--- a/SOURCES/Makefile.common
+++ b/SOURCES/Makefile.common
@@ -9,7 +9,7 @@ RPMVERSION:=3.10.0
 # marker is git tag which we base off of for exporting patches
 MARKER:=v3.10
 PREBUILD:=
-BUILD:=957.21.2
+BUILD:=957.21.3
 DIST:=.el7
 SPECFILE:=kernel.spec
 RPM:=$(REDHAT)/rpm
diff --git a/SOURCES/centos-linux-3.10-nvme-bug15723.patch b/SOURCES/centos-linux-3.10-nvme-bug15723.patch
new file mode 100644
index 0000000..9d318d9
--- /dev/null
+++ b/SOURCES/centos-linux-3.10-nvme-bug15723.patch
@@ -0,0 +1,28 @@
+centosplus patch
+
+Patch provided by RH in BZ#1671551
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 645b4f138a6c..8492e7ca4ef8 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -76,6 +76,9 @@ static void blk_mq_check_inflight(struct blk_mq_hw_ctx *hctx,
+ {
+ 	struct mq_inflight *mi = priv;
+ 
++	if (!blk_mq_request_started(rq))
++		return;
++
+ 	/*
+ 	 * index[0] counts the specific partition that was asked
+ 	 * for. index[1] counts the ones that are active on the
+@@ -103,6 +106,9 @@ static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx,
+ {
+ 	struct mq_inflight *mi = priv;
+ 
++	if (!blk_mq_request_started(rq))
++		return;
++
+ 	if (rq->part == mi->part)
+ 		mi->inflight[rq_data_dir(rq)]++;
+ }
diff --git a/SPECS/kernel-plus.spec b/SPECS/kernel-plus.spec
index 58e8866..29809ba 100644
--- a/SPECS/kernel-plus.spec
+++ b/SPECS/kernel-plus.spec
@@ -5,7 +5,7 @@ Summary: The Linux kernel
 
 %define dist .el7.centos.plus
 
-# % define buildid .local
+# %%define buildid .local
 
 # For a kernel released for public testing, released_kernel should be 1.
 # For internal testing builds during development, it should be 0.
@@ -14,10 +14,10 @@ Summary: The Linux kernel
 %global distro_build 957
 
 %define rpmversion 3.10.0
-%define pkgrelease 957.21.2.el7
+%define pkgrelease 957.21.3.el7
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 957.21.2%{?dist}
+%define specrelease 957.21.3%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -555,6 +555,7 @@ Patch20228: centos-linux-3.10-xenbus-fix-previous-patch-bug15742.patch
 #Patch20229: centos-linux-3.10-rtc_wdat-bug15830.patch
 Patch20230: centos-linux-3.10-smartpqi-bug15801.patch
 #Patch20231: centos-linux-3.10-ceph-append-write-bug15953.patch
+Patch20232: centos-linux-3.10-nvme-bug15723.patch
 
 # empty final patch to facilitate testing of kernel patches
 Patch999999: linux-kernel-test.patch
@@ -1004,6 +1005,7 @@ ApplyOptionalPatch centos-linux-3.10-xenbus-fix-previous-patch-bug15742.patch
 #ApplyOptionalPatch centos-linux-3.10-rtc_wdat-bug15830.patch
 ApplyOptionalPatch centos-linux-3.10-smartpqi-bug15801.patch
 #ApplyOptionalPatch centos-linux-3.10-ceph-append-write-bug15953.patch
+ApplyOptionalPatch centos-linux-3.10-nvme-bug15723.patch
 ### end of plus mod
 # End of CentOS Modification
 
@@ -2001,7 +2003,7 @@ fi
 %kernel_variant_files %{with_kdump} kdump
 
 %changelog
-* Tue Jun 04 2019 Akemi Yagi <toracat@centos.org> [3.10.0-957.21.2.el7.centos.plus]
+* Mon Jun 17 2019 Akemi Yagi <toracat@centos.org> [3.10.0-957.21.3.el7.centos.plus]
 - Apply debranding changes
 - Roll in i686 mods
    addmissing.patch  [puias]
@@ -2059,6 +2061,14 @@ fi
 - Apply a patch from bug15742
 - Add a patch that fixes the earlier patch from bug15742
 - Add a patch from bug#15801
+- Add a patch from bug#15723
+
+* Fri Jun 14 2019 Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.3.el7]
+- [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
+- [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
+- [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
+- [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
+- [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
 
 * Tue May 28 2019 Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.2.el7]
 - [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]