diff --git a/include/kernel-6.1 b/include/kernel-6.1
index b82ae10b7..a86b84fa0 100644
--- a/include/kernel-6.1
+++ b/include/kernel-6.1
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.1 = .13
-LINUX_KERNEL_HASH-6.1.13 = 48841319f4b0077da15e4176e624032d8332d961ee660e1b85e1ce73ded17a67
+LINUX_VERSION-6.1 = .14
+LINUX_KERNEL_HASH-6.1.14 = a27076011efec7ad11e9ed0644f512c34cab4c5ed5ba42cfe71c83fabebe810d
diff --git a/target/linux/generic/hack-6.1/221-module_exports.patch b/target/linux/generic/hack-6.1/221-module_exports.patch
index 7e43945dc..d1ff81613 100644
--- a/target/linux/generic/hack-6.1/221-module_exports.patch
+++ b/target/linux/generic/hack-6.1/221-module_exports.patch
@@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}								\
  									\
  	/* __*init sections */						\
-@@ -1043,6 +1053,8 @@
+@@ -1048,6 +1058,8 @@
  #define COMMON_DISCARDS							\
  	SANITIZER_DISCARDS						\
  	PATCHABLE_DISCARDS						\
diff --git a/target/linux/generic/hack-6.1/993-Revert-dccp-tcp-Avoid-negative-sk_forward_alloc.patch b/target/linux/generic/hack-6.1/993-Revert-dccp-tcp-Avoid-negative-sk_forward_alloc.patch
new file mode 100644
index 000000000..442ace33b
--- /dev/null
+++ b/target/linux/generic/hack-6.1/993-Revert-dccp-tcp-Avoid-negative-sk_forward_alloc.patch
@@ -0,0 +1,112 @@
+From b925cb66d56c34213ada3283b90ac21348e47ed5 Mon Sep 17 00:00:00 2001
+From: 1054009064 <44148148+1054009064@users.noreply.github.com>
+Date: Sun, 26 Feb 2023 05:50:02 +0800
+Subject: [PATCH] Revert "dccp/tcp: Avoid negative sk_forward_alloc by
+ ipv6_pinfo.pktoptions."
+
+This reverts commit ca43ccf41224b023fc290073d5603a755fd12eed.
+---
+ include/net/sock.h  | 13 -------------
+ net/dccp/ipv6.c     |  7 +++++--
+ net/ipv6/tcp_ipv6.c | 10 +++++++---
+ 3 files changed, 12 insertions(+), 18 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 573f2bf7e0de..2cb258fde072 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2411,19 +2411,6 @@ static inline __must_check bool skb_set_owner_sk_safe(struct sk_buff *skb, struc
+ 	return false;
+ }
+ 
+-static inline struct sk_buff *skb_clone_and_charge_r(struct sk_buff *skb, struct sock *sk)
+-{
+-	skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
+-	if (skb) {
+-		if (sk_rmem_schedule(sk, skb, skb->truesize)) {
+-			skb_set_owner_r(skb, sk);
+-			return skb;
+-		}
+-		__kfree_skb(skb);
+-	}
+-	return NULL;
+-}
+-
+ static inline void skb_prepare_for_gro(struct sk_buff *skb)
+ {
+ 	if (skb->destructor != sock_wfree) {
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index b9d7c3dd1cb3..4260fe466993 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -551,9 +551,11 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
+ 	*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL);
+ 	/* Clone pktoptions received with SYN, if we own the req */
+ 	if (*own_req && ireq->pktopts) {
+-		newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
++		newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);
+ 		consume_skb(ireq->pktopts);
+ 		ireq->pktopts = NULL;
++		if (newnp->pktoptions)
++			skb_set_owner_r(newnp->pktoptions, newsk);
+ 	}
+ 
+ 	return newsk;
+@@ -613,7 +615,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ 					       --ANK (980728)
+ 	 */
+ 	if (np->rxopt.all)
+-		opt_skb = skb_clone_and_charge_r(skb, sk);
++		opt_skb = skb_clone(skb, GFP_ATOMIC);
+ 
+ 	if (sk->sk_state == DCCP_OPEN) { /* Fast path */
+ 		if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
+@@ -677,6 +679,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ 			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
+ 		if (ipv6_opt_accepted(sk, opt_skb,
+ 				      &DCCP_SKB_CB(opt_skb)->header.h6)) {
++			skb_set_owner_r(opt_skb, sk);
+ 			memmove(IP6CB(opt_skb),
+ 				&DCCP_SKB_CB(opt_skb)->header.h6,
+ 				sizeof(struct inet6_skb_parm));
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 1bf93b61aa06..926adb67863f 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1388,11 +1388,14 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+ 
+ 		/* Clone pktoptions received with SYN, if we own the req */
+ 		if (ireq->pktopts) {
+-			newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
++			newnp->pktoptions = skb_clone(ireq->pktopts,
++						      sk_gfp_mask(sk, GFP_ATOMIC));
+ 			consume_skb(ireq->pktopts);
+ 			ireq->pktopts = NULL;
+-			if (newnp->pktoptions)
++			if (newnp->pktoptions) {
+ 				tcp_v6_restore_cb(newnp->pktoptions);
++				skb_set_owner_r(newnp->pktoptions, newsk);
++			}
+ 		}
+ 	} else {
+ 		if (!req_unhash && found_dup_sk) {
+@@ -1464,7 +1467,7 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ 					       --ANK (980728)
+ 	 */
+ 	if (np->rxopt.all)
+-		opt_skb = skb_clone_and_charge_r(skb, sk);
++		opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
+ 
+ 	reason = SKB_DROP_REASON_NOT_SPECIFIED;
+ 	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+@@ -1550,6 +1553,7 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ 		if (np->repflow)
+ 			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
+ 		if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
++			skb_set_owner_r(opt_skb, sk);
+ 			tcp_v6_restore_cb(opt_skb);
+ 			opt_skb = xchg(&np->pktoptions, opt_skb);
+ 		} else {
+-- 
+2.34.1
+