diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 19e054063a9..55ad604dd75 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -3,11 +3,11 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .46
+LINUX_VERSION-4.4 = .47
 LINUX_VERSION-4.9 = .8
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.46 = bb944846c5901aa2cadaa20c3d953ec03ff707dc1178e6ac3851e98747872058
+LINUX_KERNEL_HASH-4.4.47 = ce0ac0016f37ba3e9bc8ad3765933b61c4072fcfe4c44804fc7b308cd7f94de7
 LINUX_KERNEL_HASH-4.9.8 = 150bb7f2dd4849b5d21b8ccd8d05294a48229e1fcb93a22e7b806a79ec0b0e45
 
 ifdef KERNEL_PATCHVER
diff --git a/target/linux/cns3xxx/patches-4.4/200-broadcom_phy_reinit.patch b/target/linux/cns3xxx/patches-4.4/200-broadcom_phy_reinit.patch
index c3f53874f93..f3ae5e6f2bb 100644
--- a/target/linux/cns3xxx/patches-4.4/200-broadcom_phy_reinit.patch
+++ b/target/linux/cns3xxx/patches-4.4/200-broadcom_phy_reinit.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/phy/broadcom.c
 +++ b/drivers/net/phy/broadcom.c
-@@ -382,6 +382,11 @@ static int bcm5481_config_aneg(struct ph
+@@ -414,6 +414,11 @@ static int bcm5481_config_aneg(struct ph
  		/* Write bits 14:0. */
  		reg |= (1 << 15);
  		phy_write(phydev, 0x18, reg);
diff --git a/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index 5e84542bf7b..a82073b3e84 100644
--- a/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -193,7 +193,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		case -EAGAIN:
  			rtm->rtm_type = RTN_THROW;
  			break;
-@@ -3362,6 +3399,8 @@ static int ip6_route_dev_notify(struct n
+@@ -3363,6 +3400,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -3578,6 +3617,17 @@ static int __net_init ip6_route_net_init
+@@ -3579,6 +3618,17 @@ static int __net_init ip6_route_net_init
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
@@ -220,7 +220,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
  
  	net->ipv6.sysctl.flush_delay = 0;
-@@ -3596,6 +3646,8 @@ out:
+@@ -3597,6 +3647,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -229,7 +229,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -3613,6 +3665,7 @@ static void __net_exit ip6_route_net_exi
+@@ -3614,6 +3666,7 @@ static void __net_exit ip6_route_net_exi
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
  	kfree(net->ipv6.ip6_blk_hole_entry);
@@ -237,7 +237,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
  }
-@@ -3710,6 +3763,9 @@ int __init ip6_route_init(void)
+@@ -3711,6 +3764,9 @@ int __init ip6_route_init(void)
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/target/linux/ipq806x/patches-4.4/400-dsa-add-qca.patch b/target/linux/ipq806x/patches-4.4/400-dsa-add-qca.patch
index c369ab914a9..1cadba2009c 100644
--- a/target/linux/ipq806x/patches-4.4/400-dsa-add-qca.patch
+++ b/target/linux/ipq806x/patches-4.4/400-dsa-add-qca.patch
@@ -820,7 +820,7 @@ Signed-off-by: Mathieu Olivari <mathieu@codeaurora.org>
  #endif
 --- a/net/dsa/slave.c
 +++ b/net/dsa/slave.c
-@@ -1180,6 +1180,11 @@ int dsa_slave_create(struct dsa_switch *
+@@ -1182,6 +1182,11 @@ int dsa_slave_create(struct dsa_switch *
  		p->xmit = brcm_netdev_ops.xmit;
  		break;
  #endif
diff --git a/target/linux/ramips/patches-4.4/997-ralink-Introduce-fw_passed_dtb-to-arch-mips-ralink.patch b/target/linux/ramips/patches-4.4/997-ralink-Introduce-fw_passed_dtb-to-arch-mips-ralink.patch
index fb5fd98d135..bb7482e9bfa 100644
--- a/target/linux/ramips/patches-4.4/997-ralink-Introduce-fw_passed_dtb-to-arch-mips-ralink.patch
+++ b/target/linux/ramips/patches-4.4/997-ralink-Introduce-fw_passed_dtb-to-arch-mips-ralink.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/ralink/of.c
 +++ b/arch/mips/ralink/of.c
-@@ -81,13 +81,23 @@
+@@ -81,13 +81,23 @@ extern struct boot_param_header __image_
  
  void __init plat_mem_setup(void)
  {