diff --git a/SOURCES/Makefile.common b/SOURCES/Makefile.common
index a089ccd..bc5a495 100644
--- a/SOURCES/Makefile.common
+++ b/SOURCES/Makefile.common
@@ -9,7 +9,7 @@ RPMVERSION:=3.10.0
# marker is git tag which we base off of for exporting patches
MARKER:=v3.10
PREBUILD:=
-BUILD:=957.21.2
+BUILD:=957.21.3
DIST:=.el7
SPECFILE:=kernel.spec
RPM:=$(REDHAT)/rpm
diff --git a/SOURCES/centos-linux-3.10-nvme-bug15723.patch b/SOURCES/centos-linux-3.10-nvme-bug15723.patch
new file mode 100644
index 0000000..9d318d9
--- /dev/null
+++ b/SOURCES/centos-linux-3.10-nvme-bug15723.patch
@@ -0,0 +1,28 @@
+centosplus patch
+
+Patch provided by RH in BZ#1671551
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 645b4f138a6c..8492e7ca4ef8 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -76,6 +76,9 @@ static void blk_mq_check_inflight(struct blk_mq_hw_ctx *hctx,
+ {
+ struct mq_inflight *mi = priv;
+
++ if (!blk_mq_request_started(rq))
++ return;
++
+ /*
+ * index[0] counts the specific partition that was asked
+ * for. index[1] counts the ones that are active on the
+@@ -103,6 +106,9 @@ static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx,
+ {
+ struct mq_inflight *mi = priv;
+
++ if (!blk_mq_request_started(rq))
++ return;
++
+ if (rq->part == mi->part)
+ mi->inflight[rq_data_dir(rq)]++;
+ }
diff --git a/SPECS/kernel-plus.spec b/SPECS/kernel-plus.spec
index 58e8866..29809ba 100644
--- a/SPECS/kernel-plus.spec
+++ b/SPECS/kernel-plus.spec
@@ -5,7 +5,7 @@ Summary: The Linux kernel
%define dist .el7.centos.plus
-# % define buildid .local
+# %%define buildid .local
# For a kernel released for public testing, released_kernel should be 1.
# For internal testing builds during development, it should be 0.
@@ -14,10 +14,10 @@ Summary: The Linux kernel
%global distro_build 957
%define rpmversion 3.10.0
-%define pkgrelease 957.21.2.el7
+%define pkgrelease 957.21.3.el7
# allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 957.21.2%{?dist}
+%define specrelease 957.21.3%{?dist}
%define pkg_release %{specrelease}%{?buildid}
@@ -555,6 +555,7 @@ Patch20228: centos-linux-3.10-xenbus-fix-previous-patch-bug15742.patch
#Patch20229: centos-linux-3.10-rtc_wdat-bug15830.patch
Patch20230: centos-linux-3.10-smartpqi-bug15801.patch
#Patch20231: centos-linux-3.10-ceph-append-write-bug15953.patch
+Patch20232: centos-linux-3.10-nvme-bug15723.patch
# empty final patch to facilitate testing of kernel patches
Patch999999: linux-kernel-test.patch
@@ -1004,6 +1005,7 @@ ApplyOptionalPatch centos-linux-3.10-xenbus-fix-previous-patch-bug15742.patch
#ApplyOptionalPatch centos-linux-3.10-rtc_wdat-bug15830.patch
ApplyOptionalPatch centos-linux-3.10-smartpqi-bug15801.patch
#ApplyOptionalPatch centos-linux-3.10-ceph-append-write-bug15953.patch
+ApplyOptionalPatch centos-linux-3.10-nvme-bug15723.patch
### end of plus mod
# End of CentOS Modification
@@ -2001,7 +2003,7 @@ fi
%kernel_variant_files %{with_kdump} kdump
%changelog
-* Tue Jun 04 2019 Akemi Yagi <toracat@centos.org> [3.10.0-957.21.2.el7.centos.plus]
+* Mon Jun 17 2019 Akemi Yagi <toracat@centos.org> [3.10.0-957.21.3.el7.centos.plus]
- Apply debranding changes
- Roll in i686 mods
addmissing.patch [puias]
@@ -2059,6 +2061,14 @@ fi
- Apply a patch from bug15742
- Add a patch that fixes the earlier patch from bug15742
- Add a patch from bug#15801
+- Add a patch from bug#15723
+
+* Fri Jun 14 2019 Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.3.el7]
+- [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
+- [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
+- [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
+- [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
+- [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
* Tue May 28 2019 Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.2.el7]
- [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]