diff --git a/debian/changelog b/debian/changelog
index 83a45652e..a1e883bf8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,31 @@
-linux (4.19-1~exp1) UNRELEASED; urgency=medium
+linux (4.19.1-1~exp1) UNRELEASED; urgency=medium
 
   * New upstream release: https://kernelnewbies.org/Linux_4.19
+  * New upstream stable update:
+    https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.1
+    - bridge: do not add port to router list when receives query with source
+      0.0.0.0
+    - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are
+      called
+    - net/mlx5e: fix csum adjustments caused by RXFCS
+    - net: sched: gred: pass the right attribute to gred_change_table_def()
+    - net: udp: fix handling of CHECKSUM_COMPLETE packets
+    - Revert "net: simplify sock_poll_wait"
+    - rtnetlink: Disallow FDB configuration for non-Ethernet device
+    - vhost: Fix Spectre V1 vulnerability
+    - bonding: fix length of actor system
+    - openvswitch: Fix push/pop ethernet validation
+    - net/ipv6: Allow onlink routes to have a device mismatch if it is the
+      default route
+    - net: drop skb on failure in ip_check_defrag()
+    - net: Properly unlink GRO packets on overflow.
+    - r8169: fix broken Wake-on-LAN from S5 (poweroff)
+    - Revert "be2net: remove desc field from be_eq_obj"
+    - sctp: check policy more carefully when getting pr status
+    - [sparc64] Export __node_distance.
+    - [sparc64] Make corrupted user stacks more debuggable.
+    - [sparc64] Wire up compat getpeername and getsockname.
+    - net: bridge: remove ipv6 zero address check in mcast queries
 
   [ Ben Hutchings ]
   * linux-perf: Enable verbose output for build-time feature detection