diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 6080ed6aca..bdaa7f139a 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -2,12 +2,12 @@
 
 LINUX_RELEASE?=1
 
-LINUX_VERSION-3.18 = .27
+LINUX_VERSION-3.18 = .29
 LINUX_VERSION-4.1 = .20
 LINUX_VERSION-4.3 = .4
 LINUX_VERSION-4.4 = .6
 
-LINUX_KERNEL_MD5SUM-3.18.27 = 015a01bf84e7c6bc9952551b4da45044
+LINUX_KERNEL_MD5SUM-3.18.29 = b25737a0bc98e80d12200de93f239c28
 LINUX_KERNEL_MD5SUM-4.1.20 = 075c38a3a23ca5bc80437b13606df00a
 LINUX_KERNEL_MD5SUM-4.3.4 = 5275d02132107c28b85f986bad576d91
 LINUX_KERNEL_MD5SUM-4.4.6 = efc822dad2149e40cc908718a4fea1d3
diff --git a/target/linux/generic/patches-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch b/target/linux/generic/patches-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
index 7c833c4102..d3da41e918 100644
--- a/target/linux/generic/patches-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
+++ b/target/linux/generic/patches-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
@@ -44,7 +44,7 @@ Closes 20532
 
 --- a/net/ipv6/ip6_output.c
 +++ b/net/ipv6/ip6_output.c
-@@ -594,20 +594,22 @@ int ip6_fragment(struct sk_buff *skb, in
+@@ -597,20 +597,22 @@ int ip6_fragment(struct sk_buff *skb, in
  	}
  	mtu -= hlen + sizeof(struct frag_hdr);
  
@@ -69,7 +69,7 @@ Closes 20532
  				goto slow_path_clean;
  
  			/* Partially cloned skb? */
-@@ -624,8 +626,6 @@ int ip6_fragment(struct sk_buff *skb, in
+@@ -627,8 +629,6 @@ int ip6_fragment(struct sk_buff *skb, in
  
  		err = 0;
  		offset = 0;
@@ -78,7 +78,7 @@ Closes 20532
  		/* BUILD HEADER */
  
  		*prevhdr = NEXTHDR_FRAGMENT;
-@@ -633,8 +633,11 @@ int ip6_fragment(struct sk_buff *skb, in
+@@ -636,8 +636,11 @@ int ip6_fragment(struct sk_buff *skb, in
  		if (!tmp_hdr) {
  			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
  				      IPSTATS_MIB_FRAGFAILS);
@@ -91,7 +91,7 @@ Closes 20532
  
  		__skb_pull(skb, hlen);
  		fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
-@@ -732,7 +735,6 @@ slow_path:
+@@ -735,7 +738,6 @@ slow_path:
  	 */
  
  	*prevhdr = NEXTHDR_FRAGMENT;
diff --git a/target/linux/generic/patches-3.18/192-USB-qcserial-Add-support-for-Quectel-EC20-Mini-PCIe-.patch b/target/linux/generic/patches-3.18/192-USB-qcserial-Add-support-for-Quectel-EC20-Mini-PCIe-.patch
index cf5b3fe34c..7c49a6f111 100644
--- a/target/linux/generic/patches-3.18/192-USB-qcserial-Add-support-for-Quectel-EC20-Mini-PCIe-.patch
+++ b/target/linux/generic/patches-3.18/192-USB-qcserial-Add-support-for-Quectel-EC20-Mini-PCIe-.patch
@@ -61,7 +61,7 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
  /* standard device layouts supported by this driver */
  enum qcserial_layouts {
  	QCSERIAL_G2K = 0,	/* Gobi 2000 */
-@@ -166,6 +168,38 @@ static const struct usb_device_id id_tab
+@@ -171,6 +173,38 @@ static const struct usb_device_id id_tab
  };
  MODULE_DEVICE_TABLE(usb, id_table);
  
@@ -100,7 +100,7 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
  static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
  {
  	struct usb_host_interface *intf = serial->interface->cur_altsetting;
-@@ -234,6 +268,11 @@ static int qcprobe(struct usb_serial *se
+@@ -239,6 +273,11 @@ static int qcprobe(struct usb_serial *se
  			altsetting = -1;
  		break;
  	case QCSERIAL_G2K:
diff --git a/target/linux/generic/patches-3.18/532-jffs2_eofdetect.patch b/target/linux/generic/patches-3.18/532-jffs2_eofdetect.patch
index 9cbe183138..8ce53d8bed 100644
--- a/target/linux/generic/patches-3.18/532-jffs2_eofdetect.patch
+++ b/target/linux/generic/patches-3.18/532-jffs2_eofdetect.patch
@@ -1,6 +1,6 @@
 --- a/fs/jffs2/build.c
 +++ b/fs/jffs2/build.c
-@@ -114,6 +114,16 @@ static int jffs2_build_filesystem(struct
+@@ -116,6 +116,16 @@ static int jffs2_build_filesystem(struct
  	dbg_fsbuild("scanned flash completely\n");
  	jffs2_dbg_dump_block_lists_nolock(c);
  
diff --git a/target/linux/generic/patches-3.18/667-ipv6-Fixed-source-specific-default-route-handling.patch b/target/linux/generic/patches-3.18/667-ipv6-Fixed-source-specific-default-route-handling.patch
index d02e08501c..0c951069c2 100644
--- a/target/linux/generic/patches-3.18/667-ipv6-Fixed-source-specific-default-route-handling.patch
+++ b/target/linux/generic/patches-3.18/667-ipv6-Fixed-source-specific-default-route-handling.patch
@@ -26,7 +26,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv6/ip6_output.c
 +++ b/net/ipv6/ip6_output.c
-@@ -900,21 +900,45 @@ static int ip6_dst_lookup_tail(struct so
+@@ -903,21 +903,45 @@ static int ip6_dst_lookup_tail(struct so
  #endif
  	int err;