diff --git a/include/kernel-6.1 b/include/kernel-6.1
index ae82e9463..1eb754ecf 100644
--- a/include/kernel-6.1
+++ b/include/kernel-6.1
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.1 = .134
-LINUX_KERNEL_HASH-6.1.134 = 60c70cdd70ddee384c004242e67844e3dd1fe28f75b26b3586859fff0a07bd23
+LINUX_VERSION-6.1 = .135
+LINUX_KERNEL_HASH-6.1.135 = e9d17ae1ff96a771e0c5061a50cf9209ce457cf28c8e01165d611523f3957eb9
diff --git a/include/kernel-6.12 b/include/kernel-6.12
index becb518be..d31c9b412 100644
--- a/include/kernel-6.12
+++ b/include/kernel-6.12
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.12 = .24
-LINUX_KERNEL_HASH-6.12.24 = 643142c1b5991560dd12f950825cc19e4497b95b82641918ecff1177f4130c1d
+LINUX_VERSION-6.12 = .25
+LINUX_KERNEL_HASH-6.12.25 = c8af780f6f613ca24622116e4c512a764335ab66e75c6643003c16e49a8e3b90
diff --git a/include/kernel-6.6 b/include/kernel-6.6
index e3de08df9..165916457 100644
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .87
-LINUX_KERNEL_HASH-6.6.87 = 8957e5c2dacdbc47a16dbf1f6303ca7088409be6197a3881f752313275357ac6
+LINUX_VERSION-6.6 = .88
+ LINUX_KERNEL_HASH-6.6.88 = 19df89b63ef7e950de7297dabfac0569183bf87636f4c300a25336c7da490650
diff --git a/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch b/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch
index 4b4825ae3..2f4418d4f 100644
--- a/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch
+++ b/target/linux/generic/pending-6.1/620-net_sched-codel-do-not-defer-queue-length-update.patch
@@ -22,19 +22,16 @@ Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
 
 --- a/net/sched/sch_codel.c
 +++ b/net/sched/sch_codel.c
-@@ -95,11 +95,17 @@ static struct sk_buff *codel_qdisc_deque
+@@ -95,8 +95,17 @@ static struct sk_buff *codel_qdisc_deque
  			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
  			    drop_func, dequeue_func);
  
--	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
--	 * or HTB crashes. Defer it for next round.
 +	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
 +	 * parent class, dequeue in parent qdisc will do the same if we
 +	 * return skb. Temporary increment qlen if we have skb.
- 	 */
--	if (q->stats.drop_count && sch->q.qlen) {
++	 */
+ 	if (q->stats.drop_count) {
 -		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
-+	if (q->stats.drop_count) {
 +		if (skb)
 +			sch->q.qlen++;
 +		qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
@@ -68,14 +65,12 @@ Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
  	if (!skb) {
  		/* force a pass through old_flows to prevent starvation */
  		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
-@@ -314,15 +329,6 @@ begin:
+@@ -314,13 +329,6 @@ begin:
  	}
  	qdisc_bstats_update(sch, skb);
  	flow->deficit -= qdisc_pkt_len(skb);
--	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
--	 * or HTB crashes. Defer it for next round.
--	 */
--	if (q->cstats.drop_count && sch->q.qlen) {
+-
+-	if (q->cstats.drop_count) {
 -		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
 -					  q->cstats.drop_len);
 -		q->cstats.drop_count = 0;
diff --git a/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch b/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch
index 755212d9a..2f4418d4f 100644
--- a/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch
+++ b/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch
@@ -22,7 +22,7 @@ Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
 
 --- a/net/sched/sch_codel.c
 +++ b/net/sched/sch_codel.c
-@@ -65,8 +65,17 @@ static struct sk_buff *codel_qdisc_deque
+@@ -95,8 +95,17 @@ static struct sk_buff *codel_qdisc_deque
  			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
  			    drop_func, dequeue_func);
  
diff --git a/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch b/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch
index 4b4825ae3..2f4418d4f 100644
--- a/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch
+++ b/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch
@@ -22,19 +22,16 @@ Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
 
 --- a/net/sched/sch_codel.c
 +++ b/net/sched/sch_codel.c
-@@ -95,11 +95,17 @@ static struct sk_buff *codel_qdisc_deque
+@@ -95,8 +95,17 @@ static struct sk_buff *codel_qdisc_deque
  			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
  			    drop_func, dequeue_func);
  
--	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
--	 * or HTB crashes. Defer it for next round.
 +	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
 +	 * parent class, dequeue in parent qdisc will do the same if we
 +	 * return skb. Temporary increment qlen if we have skb.
- 	 */
--	if (q->stats.drop_count && sch->q.qlen) {
++	 */
+ 	if (q->stats.drop_count) {
 -		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
-+	if (q->stats.drop_count) {
 +		if (skb)
 +			sch->q.qlen++;
 +		qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
@@ -68,14 +65,12 @@ Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
  	if (!skb) {
  		/* force a pass through old_flows to prevent starvation */
  		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
-@@ -314,15 +329,6 @@ begin:
+@@ -314,13 +329,6 @@ begin:
  	}
  	qdisc_bstats_update(sch, skb);
  	flow->deficit -= qdisc_pkt_len(skb);
--	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
--	 * or HTB crashes. Defer it for next round.
--	 */
--	if (q->cstats.drop_count && sch->q.qlen) {
+-
+-	if (q->cstats.drop_count) {
 -		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
 -					  q->cstats.drop_len);
 -		q->cstats.drop_count = 0;