Downgrade to 4.1.24, because 4.1.28 turns out to be quite buggy:
- broken backport of 8f182270dfec "mm/swap.c: flush lru pvecs on compound page arrival"
- some bug resulting in soft lockup on iptables call
There are fixes queued for 4.1.29 already...