diff --git linux-libre-6.6.149-gnu/Makefile linux-libre-6.6.150-gnu/Makefile
index b998bc8e80266..fe298dc185df6 100644
--- linux-libre-6.6.149-gnu/Makefile
+++ linux-libre-6.6.150-gnu/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 6
-SUBLEVEL = 149
+SUBLEVEL = 150
 EXTRAVERSION = -gnu
 NAME = Pinguïn Aangedreven
 
diff --git linux-libre-6.6.149-gnu/arch/x86/include/asm/nospec-branch.h linux-libre-6.6.150-gnu/arch/x86/include/asm/nospec-branch.h
index 43a2daeef5efd..9a1531a43ce1d 100644
--- linux-libre-6.6.149-gnu/arch/x86/include/asm/nospec-branch.h
+++ linux-libre-6.6.150-gnu/arch/x86/include/asm/nospec-branch.h
@@ -219,11 +219,14 @@
  * The LFENCE fixes this by ensuring step 5 is never reached speculatively.
  * Note that this LFENCE only occurs if safe-RET was actually interrupted (so
  * it's outside of the normal path).
+ *
+ * (The 128 below is RIP offset, used as a naked number here for ease of
+ * backporting).
  */
 #define __HANDLE_INTR_SAFERET(name, pt_regs)		\
-	cmpq	$(name), RIP+pt_regs;			\
+	cmpq	$(name), 128+pt_regs;			\
 	jb	1f;					\
-	cmpq	$(name)+5, RIP+pt_regs;			\
+	cmpq	$(name)+5, 128+pt_regs;			\
 	ja	1f;					\
 	lfence;						\
 	leaq	pt_regs, %rdi;				\
@@ -360,7 +363,7 @@
 	__UNTRAIN_RET X86_FEATURE_ENTRY_IBPB, __stringify(RESET_CALL_DEPTH_FROM_CALL)
 
 .macro HANDLE_INTR_SAFERET pt_regs
-#ifdef CONFIG_MITIGATION_SRSO
+#ifdef CONFIG_CPU_SRSO
 	ALTERNATIVE_2 "", \
 	__stringify(__HANDLE_INTR_SAFERET(srso_safe_ret, \pt_regs)), X86_FEATURE_SRSO, \
 	__stringify(__HANDLE_INTR_SAFERET(srso_alias_safe_ret, \pt_regs)), X86_FEATURE_SRSO_ALIAS
diff --git linux-libre-6.6.149-gnu/arch/x86/kernel/cpu/bugs.c linux-libre-6.6.150-gnu/arch/x86/kernel/cpu/bugs.c
index bf57acd421869..72de35d67bc7c 100644
--- linux-libre-6.6.149-gnu/arch/x86/kernel/cpu/bugs.c
+++ linux-libre-6.6.150-gnu/arch/x86/kernel/cpu/bugs.c
@@ -3490,7 +3490,7 @@ ssize_t cpu_show_vmscape(struct device *dev, struct device_attribute *attr, char
 }
 #endif
 
-#ifdef CONFIG_MITIGATION_SRSO
+#ifdef CONFIG_CPU_SRSO
 /*
  * Called during exception/interrupt entry if interrupted during the
  * safe-RET sequence.  The safe-RET sequence consists of 3 instructions:
@@ -3527,4 +3527,4 @@ void noinstr handle_interrupted_saferet(struct pt_regs *regs)
 	/* 2. Pop rIP off the stack: */
 	regs->sp += 8;
 }
-#endif /* CONFIG_MITIGATION_SRSO */
+#endif /* CONFIG_CPU_SRSO */
