diff --git a/NetworkManager.spec b/NetworkManager.spec
index df7dfa32fc6e064da79af481c5828e5de00a6c1e..09db914da4c9d0281f7be1371c08b5c5979bec60 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -50,7 +50,7 @@
 Name:             NetworkManager
 Version:          1.26.0
 Epoch:            1
-Release:          10
+Release:          11
 Summary:          Network Link Manager and User Applications
 License:          GPLv2+
 URL:              https://www.gnome.org/projects/NetworkManager/
@@ -63,6 +63,8 @@ Patch2:           bugfix-NetworkManager-restarting-service-on-dependency-failure
 Patch3:           backport-device-fix-wrongly-considering-ipv6.may-fail-for-ipv4.patch
 Patch4:           backport-iwd-Disconnect-signals-in-NMDeviceIwd-s-dispose.patch
 Patch5:           backport-wwan-fix-leaking-bearer-in-connect-ready.patch
+Patch6:           backport-iwd-Fix-a-use-after-free.patch
+
 BuildRequires:    gcc libtool pkgconfig automake autoconf intltool gettext-devel ppp-devel gnutls-devel
 BuildRequires:    dbus-devel dbus-glib-devel  glib2-devel gobject-introspection-devel jansson-devel
 BuildRequires:    dhclient readline-devel audit-libs-devel gtk-doc libudev-devel libuuid-devel /usr/bin/valac polkit-devel
@@ -482,6 +484,12 @@ fi
 %{_datadir}/gtk-doc/html/NetworkManager/*
 
 %changelog
+* Thu Nov 11 2021 zengweifeng <zwfeng@huawei.com> - 1.26.0-11
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix use after free
+
 * Wed Oct 27 2021 gaoxingwang <gaoxingwang@huawei.com> - 1.26.0-10
 - Type:bugfix
 - ID:NA
diff --git a/backport-iwd-Fix-a-use-after-free.patch b/backport-iwd-Fix-a-use-after-free.patch
new file mode 100644
index 0000000000000000000000000000000000000000..e97554719471d2b0643054dac121e7323a1bf95f
--- /dev/null
+++ b/backport-iwd-Fix-a-use-after-free.patch
@@ -0,0 +1,43 @@
+From 09c4fa5a6cae5bef38cc6d2d0a7888e22fe85802 Mon Sep 17 00:00:00 2001
+From: Andrew Zaborowski <andrew.zaborowski@intel.com>
+Date: Fri, 23 Oct 2020 03:47:29 +0200
+Subject: [PATCH] iwd: Fix a use after free
+
+In connection_removed we use the id.name that was being g_freed a few
+lines further down.
+
+Fixes: bea6c403677f ('wifi/iwd: handle forgetting connection profiles')
+(cherry picked from commit c1ff06e11945d635c39ddaf8ec00939054fc4308)
+(cherry picked from commit 03b63a893f19f6a88385f927a7386abe534c4d04)
+---
+ src/devices/wifi/nm-iwd-manager.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+Conflict:NA
+Reference:https://gitlab.freedesktop.org/NetworkManager/NetworkManager/commit/09c4fa5a6cae5bef38cc6d2d0a7888e22fe85802
+diff --git a/src/devices/wifi/nm-iwd-manager.c b/src/devices/wifi/nm-iwd-manager.c
+index 39c863a31e..28cae87b8c 100644
+--- a/src/devices/wifi/nm-iwd-manager.c
++++ b/src/devices/wifi/nm-iwd-manager.c
+@@ -634,15 +634,16 @@ connection_removed (NMSettings *settings,
+ 	gboolean mapped;
+ 	KnownNetworkData *data;
+ 	KnownNetworkId id;
++	gs_free char *ssid_str = NULL;
+ 
+ 	id.security = nm_wifi_connection_get_iwd_security (conn, &mapped);
+ 	if (!mapped)
+ 		return;
+ 
+ 	s_wireless = nm_connection_get_setting_wireless (conn);
+-	id.name = _nm_utils_ssid_to_utf8 (nm_setting_wireless_get_ssid (s_wireless));
++	ssid_str = _nm_utils_ssid_to_utf8 (nm_setting_wireless_get_ssid (s_wireless));
++	id.name = ssid_str;
+ 	data = g_hash_table_lookup (priv->known_networks, &id);
+-	g_free ((char *) id.name);
+ 	if (!data)
+ 		return;
+ 
+-- 
+2.23.0
+