diff --git a/include/kernel-6.6 b/include/kernel-6.6
index 6a6c8aae1124..a736da59cb02 100644
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .39
-LINUX_KERNEL_HASH-6.6.39 = 2783d42112095f95c510e1b421f056df8cbfa845f9040c6115080434a77a776b
+LINUX_VERSION-6.6 = .40
+LINUX_KERNEL_HASH-6.6.40 = 5c3a3c03c055b8d601a6d7f80d1465ada6b83a12299f6ace2027b47f0baff538
diff --git a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
index 1280d2c27d6a..e1846dc8f51d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
@@ -75,7 +75,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -3658,6 +3658,48 @@ static int xhci_align_td(struct xhci_hcd
+@@ -3657,6 +3657,48 @@ static int xhci_align_td(struct xhci_hcd
  	return 1;
  }
  
@@ -124,7 +124,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* This is very similar to what ehci-q.c qtd_fill() does */
  int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
  		struct urb *urb, int slot_id, unsigned int ep_index)
-@@ -3814,6 +3856,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+@@ -3813,6 +3855,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
  	}
  
  	check_trb_math(urb, enqd_len);
@@ -133,7 +133,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
  			start_cycle, start_trb);
  	return 0;
-@@ -3949,6 +3993,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+@@ -3948,6 +3992,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
  			/* Event on completion */
  			field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);