diff --git a/Makefile.rhelver b/Makefile.rhelver
index 95b9fd7b5..dbdb99ad3 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 99
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 0
+RHEL_RELEASE = 3
 
 #
 # RHEL_REBASE_NUM
diff --git a/Patchlist.changelog b/Patchlist.changelog
index c155e8cab..e6d92af44 100644
--- a/Patchlist.changelog
+++ b/Patchlist.changelog
@@ -1,3 +1,6 @@
+https://gitlab.com/cki-project/kernel-ark/-/commit/649b9ca38bcee431bb562ad4710aadf21345914c
+ 649b9ca38bcee431bb562ad4710aadf21345914c net: gro: don't copy frags between mixed zcopy skbs
+
 https://gitlab.com/cki-project/kernel-ark/-/commit/f8e44a6ca1f248c85aa0357890c98439d49e5c31
  f8e44a6ca1f248c85aa0357890c98439d49e5c31 net/sched: fix pedit partial COW leading to page cache corruption
 
diff --git a/kernel.changelog b/kernel.changelog
index 461136f8c..d00c5a827 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,7 @@
+* Tue May 19 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.9-3]
+- net: gro: don't copy frags between mixed zcopy skbs (Sabrina Dubroca)
+Resolves: 
+
 * Mon May 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.9-0]
 - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
 - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
diff --git a/kernel.spec b/kernel.spec
index 609f8460f..691f0506f 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -190,13 +190,13 @@ Summary: The Linux kernel
 %define specrpmversion 7.0.9
 %define specversion 7.0.9
 %define patchversion 7.0
-%define pkgrelease 202
+%define pkgrelease 203
 %define kversion 7
 %define tarfile_release 7.0.9
 # This is needed to do merge window version magic
 %define patchlevel 0
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 202%{?buildid}%{?dist}
+%define specrelease 203%{?buildid}%{?dist}
 # This defines the kabi tarball version
 %define kabiversion 7.0.9
 
@@ -4825,6 +4825,9 @@ fi\
 #
 #
 %changelog
+* Tue May 19 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.9-3]
+- net: gro: don't copy frags between mixed zcopy skbs (Sabrina Dubroca)
+
 * Mon May 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.9-0]
 - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
 - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
diff --git a/patch-7.0-redhat.patch b/patch-7.0-redhat.patch
index f01406bdb..72402f698 100644
--- a/patch-7.0-redhat.patch
+++ b/patch-7.0-redhat.patch
@@ -65,7 +65,7 @@
  include/linux/rmi.h                                |    1 +
  include/linux/security.h                           |    9 +
  kernel/module/signing.c                            |    9 +-
- net/core/gro.c                                     |    4 +
+ net/core/gro.c                                     |    7 +
  net/core/skbuff.c                                  |    9 +-
  net/ipv4/tcp_output.c                              |    1 +
  net/sched/act_pedit.c                              |   72 +-
@@ -76,7 +76,7 @@
  security/lockdown/lockdown.c                       |   11 +
  tools/testing/selftests/bpf/Makefile               |    2 +-
  tools/testing/selftests/bpf/prog_tests/ksyms_btf.c |   31 -
- 78 files changed, 5465 insertions(+), 566 deletions(-)
+ 78 files changed, 5468 insertions(+), 566 deletions(-)
 
 diff --git a/Documentation/admin-guide/media/amdisp4-1.rst b/Documentation/admin-guide/media/amdisp4-1.rst
 new file mode 100644
@@ -7486,10 +7486,20 @@ index a2ff4242e623..f0d2be1ee4f1 100644
  
  int module_sig_check(struct load_info *info, int flags)
 diff --git a/net/core/gro.c b/net/core/gro.c
-index 31d21de5b15a..9f8960789b2c 100644
+index 31d21de5b15a..c7b8eab61e02 100644
 --- a/net/core/gro.c
 +++ b/net/core/gro.c
-@@ -213,10 +213,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
+@@ -123,6 +123,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
+ 	lp = NAPI_GRO_CB(p)->last;
+ 	pinfo = skb_shinfo(lp);
+ 
++	if (skb_zcopy(skb) || skb_zcopy(lp))
++		return -ETOOMANYREFS;
++
+ 	if (headlen <= offset) {
+ 		skb_frag_t *frag;
+ 		skb_frag_t *frag2;
+@@ -213,10 +216,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
  	p->data_len += len;
  	p->truesize += delta_truesize;
  	p->len += len;
@@ -7502,7 +7512,7 @@ index 31d21de5b15a..9f8960789b2c 100644
  	}
  	NAPI_GRO_CB(skb)->same_flow = 1;
  	return 0;
-@@ -244,6 +246,8 @@ int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
+@@ -244,6 +249,8 @@ int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
  	p->truesize += skb->truesize;
  	p->len += skb->len;
  
diff --git a/sources b/sources
index 502af6922..375ece1ad 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-7.0.9.tar.xz) = 40a5553bcccd34216c4925a2e1e19abea1dbb5e33b4aa1608024f96615ba05b0bb3d063d038891f828fc2dd5c8500030a8336a7db83ef0bf1a5e082d7fb92334
-SHA512 (kernel-abi-stablelists-7.0.9.tar.xz) = 286ffdaf560c750dd1cdeb069d85f95d17fd8551890b5fe767f339998accf600a0212e5050c367c6c0a5edbfeb42b63cc592d788034bb9d2a7a2f1a19c95d878
-SHA512 (kernel-kabi-dw-7.0.9.tar.xz) = 12d0027e6c27480029ac71fc88a4a7d26b6156eea52b93ca412d171839a0bdb132dca83e0fe97377d3a551dcd7d184bb4b78534421c4c7f713812438ebc9e976
+SHA512 (kernel-abi-stablelists-7.0.9.tar.xz) = 9e4f812c6756107e5eda644e02461a527913fdbfa7d2798e51b5e4c91a1bfa37488a0e06a5f81ed5282ad783d4885db96db297db924b53de17414e8d7ed30be9
+SHA512 (kernel-kabi-dw-7.0.9.tar.xz) = 9bb7d49af2456c7b09e7336a6fb6e78b2924dcb9006d3df6c1dd13033bf54ff2caf3f32de145caba3c81e14513b53e282253898fadefd2361441ea96370fe9e9