diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 75a1e1d708..ab2eaeb6ec 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -3,11 +3,11 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .71
-LINUX_VERSION-4.4 = .90
+LINUX_VERSION-4.4 = .91
 LINUX_VERSION-4.9 = .53
 
 LINUX_KERNEL_HASH-3.18.71 = 5abc9778ad44ce02ed6c8ab52ece8a21c6d20d21f6ed8a19287b4a38a50c1240
-LINUX_KERNEL_HASH-4.4.90 = 6826ccd213ac79bbfd47e63912e89ef7ec70324b7aa3684a4d4560fc2b436331
+LINUX_KERNEL_HASH-4.4.91 = cb9d2b8c1afe58414de5bc7d65429cc9f5f37c80fc229d0e83c55c5c3c254ffb
 LINUX_KERNEL_HASH-4.9.53 = 32915a33bb0b993b779257748f89f31418992edba53acbe1160cb0f8ef3cb324
 
 ifdef KERNEL_PATCHVER
diff --git a/target/linux/ar71xx/patches-4.4/930-chipidea-pullup.patch b/target/linux/ar71xx/patches-4.4/930-chipidea-pullup.patch
index 23b8e86aac..d43e8c7dc5 100644
--- a/target/linux/ar71xx/patches-4.4/930-chipidea-pullup.patch
+++ b/target/linux/ar71xx/patches-4.4/930-chipidea-pullup.patch
@@ -58,7 +58,7 @@
  		return;
 +	}
  
- 	if (hw_read_otgsc(ci, OTGSC_BSV))
+ 	if (hw_read_otgsc(ci, OTGSC_BSV) && !ci->vbus_active)
  		usb_gadget_vbus_connect(&ci->gadget);
 --- a/include/linux/usb/chipidea.h
 +++ b/include/linux/usb/chipidea.h
diff --git a/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index 0616eaa7c0..b7ba384f4c 100644
--- a/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -17,7 +17,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -4256,6 +4256,9 @@ static enum gro_result dev_gro_receive(s
+@@ -4259,6 +4259,9 @@ static enum gro_result dev_gro_receive(s
  	enum gro_result ret;
  	int grow;
  
@@ -27,7 +27,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!(skb->dev->features & NETIF_F_GRO))
  		goto normal;
  
-@@ -5422,6 +5425,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -5425,6 +5428,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *private)
-@@ -5493,6 +5538,7 @@ static int __netdev_upper_dev_link(struc
+@@ -5496,6 +5541,7 @@ static int __netdev_upper_dev_link(struc
  			goto rollback_lower_mesh;
  	}
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  	return 0;
-@@ -5619,6 +5665,7 @@ void netdev_upper_dev_unlink(struct net_
+@@ -5622,6 +5668,7 @@ void netdev_upper_dev_unlink(struct net_
  	list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
  		__netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
  
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  }
-@@ -6159,6 +6206,7 @@ int dev_set_mac_address(struct net_devic
+@@ -6162,6 +6209,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;
diff --git a/target/linux/generic/pending-4.4/721-phy_packets.patch b/target/linux/generic/pending-4.4/721-phy_packets.patch
index 89ffdc558d..a7a23278d0 100644
--- a/target/linux/generic/pending-4.4/721-phy_packets.patch
+++ b/target/linux/generic/pending-4.4/721-phy_packets.patch
@@ -86,7 +86,7 @@
  	help
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -2743,10 +2743,20 @@ static int xmit_one(struct sk_buff *skb,
+@@ -2746,10 +2746,20 @@ static int xmit_one(struct sk_buff *skb,
  	if (!list_empty(&ptype_all) || !list_empty(&dev->ptype_all))
  		dev_queue_xmit_nit(skb, dev);
  
diff --git a/target/linux/oxnas/patches-4.4/250-add-plxtech-vendor-prefix.patch b/target/linux/oxnas/patches-4.4/250-add-plxtech-vendor-prefix.patch
index d6c5c627a6..a94ac2277b 100644
--- a/target/linux/oxnas/patches-4.4/250-add-plxtech-vendor-prefix.patch
+++ b/target/linux/oxnas/patches-4.4/250-add-plxtech-vendor-prefix.patch
@@ -1,6 +1,6 @@
 --- a/Documentation/devicetree/bindings/vendor-prefixes.txt
 +++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
-@@ -174,6 +174,7 @@ picochip	Picochip Ltd
+@@ -175,6 +175,7 @@ picochip	Picochip Ltd
  plathome	Plat'Home Co., Ltd.
  plda	PLDA
  pixcir  PIXCIR MICROELECTRONICS Co., Ltd