diff --git a/.github/workflows/rpm-build.yml b/.github/workflows/rpm-build.yml
index 75bae29f14166..eb9a0e938b476 100644
--- a/.github/workflows/rpm-build.yml
+++ b/.github/workflows/rpm-build.yml
@@ -9,17 +9,21 @@ jobs:
   rpm-build-job:
     strategy:
       matrix:
+        arch:
+          - x86_64
+          - aarch64
+        el_version:
+          - 9
+          - 10
         include:
           - arch: x86_64
             runner: kernel-build
-            mock_config: rocky-9-x86_64
           - arch: aarch64
             runner: kernel-build-arm64
-            mock_config: rocky-9-aarch64
     runs-on:
       labels: ${{ matrix.runner }}
     container:
-      image: rockylinux/rockylinux:9
+      image: rockylinux/rockylinux:${{ matrix.el_version }}
       options: --privileged --cpus 8
     steps:
       - name: Install tools and libraries
@@ -41,13 +45,14 @@ jobs:
           ./ciq/SOURCES/generate_tarball.sh
 
       - name: Bundle bindgen
+        if: matrix.el_version == 9
         run: ./ciq/SOURCES/bundle_bindgen.sh ./ciq/SOURCES
 
       - name: Build SRPM
         run: |
           mkdir -p ../build_files
           chown mockbuild:mock ../build_files
-          su mockbuild -c "mock -v -r ${{ matrix.mock_config }} --resultdir=$(pwd)/../build_files \
+          su mockbuild -c "mock -v -r rocky-${{ matrix.el_version }}-${{ matrix.arch }} --resultdir=$(pwd)/../build_files \
             --buildsrpm \
             --sources=$(pwd)/ciq/SOURCES \
             --spec=$(pwd)/ciq/SPECS/kernel-clk6.18.spec"
@@ -55,4 +60,4 @@ jobs:
       - name: Build RPM
         run: |
           SRPM=$(ls ../build_files/*.src.rpm | head -1)
-          su mockbuild -c "mock -v -r ${{ matrix.mock_config }} --resultdir=$(pwd)/../build_files $SRPM"
+          su mockbuild -c "mock -v -r rocky-${{ matrix.el_version }}-${{ matrix.arch }} --resultdir=$(pwd)/../build_files $SRPM"
diff --git a/ciq/SOURCES/generate_tarball.sh b/ciq/SOURCES/generate_tarball.sh
index 40958c2feca6a..fbbb6296444ca 100755
--- a/ciq/SOURCES/generate_tarball.sh
+++ b/ciq/SOURCES/generate_tarball.sh
@@ -15,7 +15,20 @@ KERNEL_MAJOR_MINOR=$(grep '^%define kernel_major_minor' "$SPEC_FILE" | awk '{pri
 KERNEL_PATCH=$(grep '^%define kernel_patch' "$SPEC_FILE" | awk '{print $3}')
 BUILDID=$(grep '^%define buildid' "$SPEC_FILE" | awk '{print $3}')
 PKGRELEASE=$(grep '^%define pkgrelease' "$SPEC_FILE" | awk '{print $3}')
-EL_VERSION=$(grep '^%define el_version' "$SPEC_FILE" | awk '{print $3}')
+
+# el_version can be passed as first argument, or falls back to the buildroot's
+# %{rhel} macro (matching the spec's %{!?el_version: %define el_version %{rhel}}).
+if [ -n "$1" ]; then
+    EL_VERSION="$1"
+else
+    EL_VERSION=$(rpm --eval '%{rhel}' 2>/dev/null)
+    if [ -z "$EL_VERSION" ] || echo "$EL_VERSION" | grep -q '%{'; then
+        echo "Error: Could not determine el_version."
+        echo "Usage: $0 [el_version]"
+        echo "  e.g. $0 9   or   $0 10"
+        exit 1
+    fi
+fi
 
 if [ -z "$KERNEL_MAJOR_MINOR" ] || [ -z "$KERNEL_PATCH" ] || [ -z "$PKGRELEASE" ] || [ -z "$EL_VERSION" ]; then
     echo "Error: Could not extract kernel version from $SPEC_FILE"
diff --git a/ciq/SPECS/kernel-clk6.18.spec b/ciq/SPECS/kernel-clk6.18.spec
index e188cc5c4c60d..c5adb1ed52142 100644
--- a/ciq/SPECS/kernel-clk6.18.spec
+++ b/ciq/SPECS/kernel-clk6.18.spec
@@ -166,7 +166,6 @@ Summary: The Linux kernel
 #  to build the base kernel using the debug configuration. (Specifying
 #  the --with-release option overrides this setting.)
 %define debugbuildsenabled 1
-%define el_version 9
 %define kernel_major_minor 6.18
 %define kernel_patch 43
 %define buildid .1
@@ -174,7 +173,7 @@ Summary: The Linux kernel
 %define pkgrelease 1%{?buildid}
 %define kversion %{lua:print((rpm.expand("%{kernel_major_minor}"):match("^(%d+)")))}
 
-%define tarfile_release %{specversion}-%{pkgrelease}.el%{el_version}
+%define tarfile_release %{specversion}-%{pkgrelease}.el%{rhel}
 # This is needed to do merge window version magic
 %define patchlevel %{lua:print((rpm.expand("%{kernel_major_minor}"):match("%.(%d+)$")))}
 # This allows pkg_release to have configurable %%{?dist} tag
@@ -757,6 +756,9 @@ BuildRequires: zstd
 %endif
 BuildRequires: gcc, binutils, redhat-rpm-config, hmaccalc, bison, flex, gcc-c++
 BuildRequires: rust, rust-src, rustfmt, clippy
+%if 0%{?rhel} >= 10
+BuildRequires: bindgen-cli
+%endif
 BuildRequires: net-tools, hostname, bc, elfutils-devel
 BuildRequires: dwarves
 BuildRequires: python3
@@ -1169,8 +1171,10 @@ Source3002: Patchlist.changelog
 
 Source4000: README.rst
 
-# Bundled bindgen-cli source (not packaged in Rocky 9.6)
+# Bundled bindgen-cli source (not packaged in Rocky 9)
+%if 0%{?rhel} < 10
 Source5000: bindgen-cli.tar.gz
+%endif
 
 ## Patches needed for building this package
 
@@ -2287,8 +2291,9 @@ cp_vmlinux()
 %define build_hostldflags %{?build_ldflags}
 %endif
 
-# Build bundled bindgen and add to PATH
-%{log_msg "Build bindgen"}
+%if 0%{?rhel} < 10
+# Build bundled bindgen and add to PATH (not packaged in Rocky 9)
+%{log_msg "Build bundled bindgen"}
 BINDGEN_DIR=$RPM_BUILD_ROOT/bindgen
 BINDGEN_BUNDLE_NAME=$(basename %{SOURCE5000} .tar.gz)
 mkdir -p $BINDGEN_DIR
@@ -2297,6 +2302,9 @@ pushd $BINDGEN_DIR/$BINDGEN_BUNDLE_NAME
 cargo build --offline --frozen --release
 export PATH="$PWD/target/release:$PATH"
 popd
+%else
+%{log_msg "Using system bindgen"}
+%endif
 bindgen --version
 
 %define make %{__make} %{?cross_opts} %{?make_opts} HOSTCFLAGS="%{?build_hostcflags}" HOSTLDFLAGS="%{?build_hostldflags}"
diff --git a/crypto/rng.c b/crypto/rng.c
index c38b55abd99b9..0dfaf73f38374 100644
--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -338,7 +338,7 @@ lock_default_rng(struct crypto_rng **rng) __acquires(&cri->lock)
 		 *
 		 * Note that this task may be migrated to a different CPU now!
 		 */
-		local_unlock(&cri->lock);
+		local_unlock(&pcri->lock);
 		rt_mutex_lock(&cri->mlock);
 		if (!cri->rng) {
 			struct crypto_rng *new_rng = NULL;
@@ -411,7 +411,7 @@ do {						\
 	if (reseed)				\
 		rt_mutex_unlock(&(cri)->mlock);	\
 	else					\
-		local_unlock(&(cri)->lock);	\
+		local_unlock(&pcpu_default_rng.lock);	\
 } while (0)
 
 static __always_inline void